Skip to main content

Thrift CVE-2026-49158

| EUVDEUVD-2026-49151 HIGH
Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)
2026-07-24 GHSA-jcj7-w43p-gjh8
Apache Information Disclosure Red Hat Suse Thrift
7.5
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Patch available
Jul 27, 2026 - 12:16 EUVD
Analysis Generated
Jul 26, 2026 - 12:08 vuln.today
CVE Published
Jul 24, 2026 - 22:38 oss-security
HIGH 7.5
CVE Published
Jul 24, 2026 - 22:38 oss-security
HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Denial of service in Apache Thrift Ruby bindings before 0.24.0 allows unauthenticated remote attackers to exhaust server resources by sending highly compressed data. No active exploitation or public exploit code has been observed at time of analysis. Upgrading to version 0.24.0 resolves the vulnerability.

More in Thrift

View all
CVE-2021-24028 CRITICAL
9.8 Apr 14

An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code e
CVE-2026-55971 CRITICAL
9.3 Jul 24

Heap-based buffer overflow in Apache Thrift C++ THeaderTransport::untransform() allows remote code execution by sending

CVE-2026-48144 CRITICAL
9.1 Jul 24

Improper certificate validation in Apache Thrift c_glib TLS clients allows man-in-the-middle attackers to intercept or t
CVE-2026-58662 HIGH
8.7 Jul 24

Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an ou
CVE-2026-58389 HIGH
8.7 Jul 24

Denial of service vulnerability in Apache Thrift Rust bindings prior to 0.24.0 allows remote attackers to exhaust memory
CVE-2026-55969 HIGH
8.7 Jul 24

Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affe
CVE-2026-55968 HIGH
8.7 Jul 24

Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU r
CVE-2026-48586 HIGH
8.7 Jul 24

Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources b
CVE-2026-43871 HIGH
8.7 Jul 24

Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger in
CVE-2026-48145 HIGH
8.2 Jul 24

TLS hostname verification bypass in Apache Thrift C++ bindings allows man-in-the-middle interception of Thrift RPC commu
CVE-2026-41604 HIGH
8.2 Apr 28

Out-of-bounds read vulnerability in Apache Thrift Swift implementation allows remote unauthenticated attackers to trigge
CVE-2019-3565 HIGH
7.5 May 06

Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers o

Same weakness CWE-409 – Improper Handling of Highly Compressed Data (Data Amplification)

View all
CVE-2026-59803 HIGH POC
8.7
CVE-2026-49755 HIGH POC
8.2
CVE-2026-48594 HIGH POC
8.2
CVE-2026-59939 HIGH POC
7.5
CVE-2024-7765 HIGH POC
7.5
CVE-2026-22776 HIGH POC
7.5
CVE-2026-22870 HIGH POC
7.5
CVE-2024-3572 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed

Share

CVE-2026-49158 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy