Riskcovery

CVE-2026-48586

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit

State
Published
Severity
8.7 High
Published
Jul 27, 2026
Updated
Jul 27, 2026
Reserved
May 21, 2026

Read the record on cve.org

Description

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Scores

CVSSScoreVectorSource
4.08.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:Napache

Weaknesses

  • CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

Affected Products

ProductVersions
Apache ThriftApache Software Foundation
  • before 0.24.0Affected
Apache ThriftApache Software Foundation
  • before 0.24.0Affected
Apache ThriftApache Software Foundation
  • before 0.24.0Affected
Apache ThriftApache Software Foundation
  • before 0.24.0Affected
Apache ThriftApache Software Foundation
  • before 0.24.0Affected
Apache ThriftApache Software Foundation
  • before 0.24.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.