vulnerabilityCVE-2026-94657

Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound

Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Severity

8.2High

Exploitation evidence

None confirmed

Remediation

Fixed in 0.25.0

Affected software

Software	Affected versions	Fixed in	Sources

CVSS (Common Vulnerability Scoring System)

Preferred assessment

Vector

Attack vector

Attack complexity

Privileges required

User interaction

Scope

Confidentiality impact

Integrity impact

Availability impact

Source assessments

EPSS (Exploit Prediction Scoring System)

Probability

Percentile

Model

Preferred remediation

Action