CVE-2026-94636

Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up

State: Published
Severity: 8.2 High
Published: Oct 2, 2026
Updated: Oct 2, 2026
Reserved: Sep 21, 2026

Description

Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Scores

CVSS	Score	Vector	Source
4.0	8.2 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	apache

Weaknesses

CWE-409 Improper handling of highly compressed data (data amplification)
CWE-628 Function call with incorrectly specified arguments
CWE-1284 Improper validation of specified quantity in input

Affected Products

Product	Versions
Apache ThriftApache Software Foundation	before 0.25.0Affected

References

https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1vendor-advisory
https://lists.apache.org/thread/1rpq0d0g6yzjjzl1z27lwmvhzkn6rbrsvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.