Skip to main content

Apache Thrift EUVDEUVD-2026-49155

| CVE-2026-55971 CRITICAL
Heap-based Buffer Overflow (CWE-122)
2026-07-24 GHSA-gwj4-q93m-wwqc
Apache Buffer Overflow Heap Overflow Thrift Red Hat Suse
9.3
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.8 CRITICAL

Network-accessible service, low complexity, no auth, no interaction; heap overflow allows arbitrary code execution.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative
Red Hat
8.4 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Jul 27, 2026 - 12:16 EUVD
Analysis Generated
Jul 26, 2026 - 12:09 vuln.today
CVE Published
Jul 24, 2026 - 22:49 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Heap-based buffer overflow in Apache Thrift C++ THeaderTransport::untransform() allows remote code execution by sending specially crafted compressed data. Affects all versions prior to 0.24.0. No active exploitation or public exploit code has been reported at this time.

Technical ContextAI

Apache Thrift is an RPC framework enabling cross-language service development. The vulnerability resides in the C++ binding's THeaderTransport, specifically the untransform() method that handles ZLIB decompression. A heap buffer overflow (CWE-122) occurs due to improper validation of decompressed data size, allowing an attacker to overwrite adjacent heap memory. CPE data is unavailable, but the affected component is the C++ Thrift library linked into any service using THeaderTransport with ZLIB compression.

RemediationAI

Upgrade to Apache Thrift 0.24.0 or later, which contains the fix. No workarounds are described; if immediate upgrade is not possible, restrict network access to Thrift endpoints or disable ZLIB compression in THeaderTransport if feasible, noting this may break protocol negotiation with clients expecting compressed frames. Monitor the vendor advisory for any patch availability or further guidance.

More in Thrift

View all
CVE-2021-24028 CRITICAL
9.8 Apr 14

An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code e
CVE-2026-48144 CRITICAL
9.1 Jul 24

Improper certificate validation in Apache Thrift c_glib TLS clients allows man-in-the-middle attackers to intercept or t
CVE-2026-58662 HIGH
8.7 Jul 24

Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an ou
CVE-2026-58389 HIGH
8.7 Jul 24

Denial of service vulnerability in Apache Thrift Rust bindings prior to 0.24.0 allows remote attackers to exhaust memory
CVE-2026-55969 HIGH
8.7 Jul 24

Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affe
CVE-2026-55968 HIGH
8.7 Jul 24

Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU r
CVE-2026-48586 HIGH
8.7 Jul 24

Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources b
CVE-2026-43871 HIGH
8.7 Jul 24

Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger in
CVE-2026-48145 HIGH
8.2 Jul 24

TLS hostname verification bypass in Apache Thrift C++ bindings allows man-in-the-middle interception of Thrift RPC commu
CVE-2026-41604 HIGH
8.2 Apr 28

Out-of-bounds read vulnerability in Apache Thrift Swift implementation allows remote unauthenticated attackers to trigge
CVE-2019-3565 HIGH
7.5 May 06

Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers o
CVE-2019-3558 HIGH
7.5 May 06

Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. Rated

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8
CVE-2025-24993 HIGH
7.8
CVE-2024-30085 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Package Hub 15 SP7 Fixed
openSUSE Tumbleweed Fixed
SUSE Package Hub 15 SP7 Affected

Share

EUVD-2026-49155 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy