PT-2026-64877 · Apache · Apache Thrift

CVE-2026-41608 · Published 2026-07-27 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0

Description Improper handling of highly compressed data, known as data amplification, exists in the Apache Thrift Python bindings. This issue occurs during unbounded Zlib decompression within the THeaderTransport component.

Recommendations Upgrade to version 0.24.0.

Fix

Weakness Enumeration

CWE-409

Related Identifiers

CVE-2026-41608

Affected Products

Apache Thrift

References · 5

• https://lists.apache.org/thread/vwsbcwqdpwdtp8qkjo11ol6rodbfm21f · Vendor Advisory
• https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41608 · Security Note
• http://openwall.com/lists/oss-security/2026/07/24/32 · Note
• https://t.me/CVEtracker/61321 · Telegram Post