How severe is CVE-2026-92834?

CVE-2026-92834 has a CVSS 4.0 base score of 6.3, rated medium severity.

Is CVE-2026-92834 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-92834?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-92834 published?

CVE-2026-92834 was published on 2026-10-02.

CVE-2026-92834

CVE-2026-92834 is a medium-severity vulnerability with a CVSS 4.0 base score of 6.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-393.

Key facts

Severity: Medium (CVSS 4.0 base score 6.3)
EPSS exploit prediction: 0% (35th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-393
Published: 2026-10-02
Last modified: 2026-10-02

Description

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Frequently asked questions

What is CVE-2026-92834?: Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
How severe is CVE-2026-92834?: CVE-2026-92834 has a CVSS 4.0 base score of 6.3, rated medium severity.
Is CVE-2026-92834 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-92834?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-92834 published?: CVE-2026-92834 was published on 2026-10-02.

References

Other CWE-393 vulnerabilities

CVE-2024-49117 — High (CVSS 8.8): Windows Hyper-V Remote Code Execution Vulnerability
CVE-2025-5987 — High (CVSS 8.1): A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust…
CVE-2026-53092 — High (CVSS 7.8): In the Linux kernel, the following vulnerability has been resolved: bpf: Fix linked reg delta tracking when src_reg ==…
CVE-2026-92821 — Medium (CVSS 6.8): A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in…
CVE-2025-24531 — Medium (CVSS 6.7): In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as…
CVE-2026-85483 — Medium (CVSS 6.3): Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings. This…

Browse all CWE-393 vulnerabilities →