CVE-2026-96292: CWE-1333 Inefficient regular expression complexity in Apache Software Foundation Apache Thrift
CVE-2026-96292 is a high-severity vulnerability in Apache Thrift affecting versions before 0.25.0. It involves inefficient regular expression complexity in the Lua bindings, leading to an inefficient algorithmic complexity issue. This can potentially cause performance degradation or denial of service conditions. The Apache Software Foundation has fixed this issue in version 0.25.0. Users are advised to upgrade to this version to mitigate the vulnerability.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-96292) in Apache Thrift's Lua bindings is due to inefficient regular expression complexity, classified under CWE-1333 and CWE-407. It results in inefficient algorithmic complexity that can be exploited to degrade service performance. The issue affects all versions prior to 0.25.0. The Apache Software Foundation has addressed the vulnerability in version 0.25.0.
Potential Impact
The vulnerability can lead to high-impact consequences such as denial of service or significant performance degradation due to inefficient processing of regular expressions in the Lua bindings of Apache Thrift. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
A fix is available in Apache Thrift version 0.25.0. Users should upgrade to this version to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.
CVE-2026-96292: CWE-1333 Inefficient regular expression complexity in Apache Software Foundation Apache Thrift
Description
CVE-2026-96292 is a high-severity vulnerability in Apache Thrift affecting versions before 0.25.0. It involves inefficient regular expression complexity in the Lua bindings, leading to an inefficient algorithmic complexity issue. This can potentially cause performance degradation or denial of service conditions. The Apache Software Foundation has fixed this issue in version 0.25.0. Users are advised to upgrade to this version to mitigate the vulnerability.
CVSS v4.0
Score 8.2high
Affected software
Apache Software Foundation
Apache Thrift
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-96292) in Apache Thrift's Lua bindings is due to inefficient regular expression complexity, classified under CWE-1333 and CWE-407. It results in inefficient algorithmic complexity that can be exploited to degrade service performance. The issue affects all versions prior to 0.25.0. The Apache Software Foundation has addressed the vulnerability in version 0.25.0.
Potential Impact
The vulnerability can lead to high-impact consequences such as denial of service or significant performance degradation due to inefficient processing of regular expressions in the Lua bindings of Apache Thrift. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
A fix is available in Apache Thrift version 0.25.0. Users should upgrade to this version to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-09-22T21:39:49.893Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abf961ea43b0b3b89af9971
Added to database: 10/02/2026, 11:31:42 UTC
Last enriched: 10/02/2026, 11:46:05 UTC
Last updated: 10/02/2026, 11:46:05 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.