Skip to main content

Thrift CVE-2026-48586

| EUVDEUVD-2026-49150 HIGH
Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)
2026-07-24 GHSA-6h9h-5c4r-fqgf
Python Apache Information Disclosure Red Hat Suse Thrift
8.7
CVSS 4.0 · Vendor
View

Vulnerability Assessment

Weakness
CWE
CWE-409
ASVS 5.0
V2 - Validation and Business Logic Compression ratio limits
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 1.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 26, 2026

Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources by sending highly compressed data that decompresses to disproportionate sizes. Affecting all language bindings before version 0.24.0, the flaw enables denial of service via ZIP-bomb-style attacks. Upgrading to Thrift 0.24.0 provides a fix.

Affected VersionsENISA

Apache Thrift 0 <0.24.0

Affected Packages

euvd apache_thrift fix: 0.24.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Thrift gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch available
Jul 27, 2026 - 12:16 EUVD
CVE Published
Jul 24, 2026 - 22:36 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Threat Intelligence Overview

EPSS Score
1.1%
Top 38% exploitable
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 1.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

45
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Thrift

View all
CVE-2021-24028 CRITICAL
9.8 Apr 14

An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code e
CVE-2026-55971 CRITICAL
9.3 Jul 24

Heap-based buffer overflow in Apache Thrift C++ THeaderTransport::untransform() allows remote code execution by sending

CVE-2026-48144 CRITICAL
9.1 Jul 24

Improper certificate validation in Apache Thrift c_glib TLS clients allows man-in-the-middle attackers to intercept or t
CVE-2026-58662 HIGH
8.7 Jul 24

Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an ou
CVE-2026-58389 HIGH
8.7 Jul 24

Denial of service vulnerability in Apache Thrift Rust bindings prior to 0.24.0 allows remote attackers to exhaust memory
CVE-2026-55969 HIGH
8.7 Jul 24

Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affe
CVE-2026-55968 HIGH
8.7 Jul 24

Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU r
CVE-2026-43871 HIGH
8.7 Jul 24

Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger in
CVE-2026-48145 HIGH
8.2 Jul 24

TLS hostname verification bypass in Apache Thrift C++ bindings allows man-in-the-middle interception of Thrift RPC commu
CVE-2026-41604 HIGH
8.2 Apr 28

Out-of-bounds read vulnerability in Apache Thrift Swift implementation allows remote unauthenticated attackers to trigge
CVE-2019-3565 HIGH
7.5 May 06

Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers o
CVE-2019-3558 HIGH
7.5 May 06

Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. Rated

Same weakness CWE-409 – Improper Handling of Highly Compressed Data (Data Amplification)

View all
CVE-2026-77620 HIGH POC
8.7
CVE-2026-59803 HIGH POC
8.7
CVE-2026-49755 HIGH POC
8.2
CVE-2026-48594 HIGH POC
8.2
CVE-2026-59939 HIGH POC
7.5
CVE-2024-7765 HIGH POC
7.5
CVE-2026-22776 HIGH POC
7.5
CVE-2026-22870 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:43581 ADVISORY https://access.redhat.com/errata/RHSA-2026:43799 ADVISORY https://access.redhat.com/errata/RHSA-2026:45780 ADVISORY https://access.redhat.com/errata/RHSA-2026:46931 ADVISORY https://access.redhat.com/errata/RHSA-2026:46974 ADVISORY https://access.redhat.com/errata/RHSA-2026:46987 ADVISORY https://access.redhat.com/errata/RHSA-2026:46989 ADVISORY https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9 ADVISORY https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-48586 ADVISORY https://seclists.org/oss-sec/2026/q3/265 ADVISORY https://thrift.apache.org/ ADVISORY https://vuldb.com/vuln/383334 REF http://www.openwall.com/lists/oss-security/2026/07/24/37

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy