PT-2026-64877 · Apache · Apache Thrift

CVE-2026-41608

·

Published

2026-07-27

·

Updated

2026-09-10

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0
Description Improper handling of highly compressed data, known as data amplification, exists in the Apache Thrift Python bindings. This issue occurs during unbounded Zlib decompression within the THeaderTransport component.
Recommendations Upgrade to version 0.24.0.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-409

Related Identifiers

AZL-93989
BIT-THRIFT-2026-41608
CVE-2026-41608
ECHO-3407-BA73-148E
GHSA-6PJX-3PJC-MRJ8
OPENSUSE-SU-2026:11432-1
PYSEC-2026-3925
RHSA-2026:49837

Affected Products

Apache Thrift