EUVD-2026-49155
GHSA-gwj4-q93m-wwqc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious compressed payload
-
DeliverySend via Thrift THeaderTransport protocol to target
-
ExploitServer decompresses payload in ZLIB untransform()
-
ExecutionHeap buffer overflow corrupts memory
-
PersistExecute attacker-supplied code
-
ImpactGain full control of the server
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The service must be implemented in C++ and use THeaderTransport with ZLIB compression enabled. No authentication or user interaction is required if the service is network-accessible and accepts compressed frames by default. If the service is not exposed or uses a different transport configuration, it is not vulnerable. |
| Impact | No CVSS vector, EPSS score, KEV status, or POC information is available. Based on the description, exploitation is likely network-based with low complexity and no authentication required, suggesting a critical severity if such services are exposed. However, the real-world risk depends on the prevalence of C++ Thrift services using ZLIB compression in THeaderTransport. Without exploit maturity data, the immediate priority is reduced, but upgrading is strongly recommended to prevent future exploitation. |
| Exploit ScenarioDerived | An attacker transmits a maliciously crafted compressed Thrift message to an exposed service. When the C++ server decompresses the payload via THeaderTransport::untransform(), a heap buffer overflow is triggered, corrupting memory and enabling remote code execution with the privileges of the server process. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 26, 2026
Heap-based buffer overflow in Apache Thrift C++ THeaderTransport::untransform() allows remote code execution by sending specially crafted compressed data. Affects all versions prior to 0.24.0. No active exploitation or public exploit code has been reported at this time.
RemediationAI
Upgrade to Apache Thrift 0.24.0 or later, which contains the fix. No workarounds are described; if immediate upgrade is not possible, restrict network access to Thrift endpoints or disable ZLIB compression in THeaderTransport if feasible, noting this may break protocol negotiation with clients expecting compressed frames. Monitor the vendor advisory for any patch availability or further guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Thrift is an RPC framework enabling cross-language service development. The vulnerability resides in the C++ binding's THeaderTransport, specifically the untransform() method that handles ZLIB decompression. A heap buffer overflow (CWE-122) occurs due to improper validation of decompressed data size, allowing an attacker to overwrite adjacent heap memory. CPE data is unavailable, but the affected component is the C++ Thrift library linked into any service using THeaderTransport with ZLIB compression.
Know when Thrift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-accessible service, low complexity, no auth, no interaction; heap overflow allows arbitrary code execution.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code e
Improper certificate validation in Apache Thrift c_glib TLS clients allows man-in-the-middle attackers to intercept or t
Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an ou
Denial of service vulnerability in Apache Thrift Rust bindings prior to 0.24.0 allows remote attackers to exhaust memory
Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affe
Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU r
Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources b
Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger in
TLS hostname verification bypass in Apache Thrift C++ bindings allows man-in-the-middle interception of Thrift RPC commu
Out-of-bounds read vulnerability in Apache Thrift Swift implementation allows remote unauthenticated attackers to trigge
Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers o
Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. Rated
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB