Apache Thrift <0.24: Improper Data Amplification Vulnerability
CVE-2026-48586 Published on July 27, 2026

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Vendor Advisory Vendor Advisory NVD

Weakness Type

What is a Data Amplification Vulnerability?

The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.

CVE-2026-48586 has been classified to as a Data Amplification vulnerability or weakness.


Products Associated with CVE-2026-48586

Want to know whenever a new CVE is published for Apache Thrift? stack.watch will email you.

Apache Thrift
 

Affected Versions

Apache Software Foundation Apache Thrift: Apache Software Foundation Apache Thrift: Apache Software Foundation Apache Thrift: Apache Software Foundation Apache Thrift: Apache Software Foundation Apache Thrift: Apache Software Foundation Apache Thrift: