CVE-2026-96286 - Apache Thrift: Perl servers end `serve()` when serving one connection fails

Back Back to CVE browser

HIGH

Apache Thrift: Perl servers end `serve()` when serving one connection fails

Published Oct 2, 2026

8.2

HIGH

CVSS 4.0

EPSS 0.43%

Description

Uncaught exception vulnerability in Apache Thrift Perl bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Affected products

Vendor Apache Software Foundation Product Apache Thrift Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <0.25.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache Thrift

unaffected

Version	Status	Constraints
0	affected	<0.25.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-248

References (2)

https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1
vendor-advisory
https://lists.apache.org/thread/o5386v7ytbbjv9sx7dbszw46ypod5yd9
vendor-advisory

Link	Providers	Tags
https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1		vendor-advisory
https://lists.apache.org/thread/o5386v7ytbbjv9sx7dbszw46ypod5yd9		vendor-advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner apache

Published Oct 2, 2026

Updated Oct 2, 2026

Reserved Sep 22, 2026

Link CVE-2026-96286

CISA Vulnrichment

Updated Oct 2, 2026

NVD

Status Deferred

Modified Oct 2, 2026

Link CVE-2026-96286

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-96286