Is CVE-2026-41608 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41608 being exploited in the wild.

How severe is CVE-2026-41608?

High severity, with a CVSS score of 7.5, published 27 July 2026.

Which products and versions are affected?

Apache Thrift before 0.24.0; thrift (PyPI) ECOSYSTEM:introduced=0,fixed=0.24.0.

Is there a fix for CVE-2026-41608?

Yes. thrift (PyPI): upgrade to 0.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41608 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41608?

Check whether you run Apache Thrift or thrift (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41608: Apache Thrift data amplification in Python THeaderTransport

CVE-2026-41608 · Severity: high · CVSS 7.5 · Published 2026-07-27

Apache Thrift is a widely-used framework for building distributed services and APIs. The Python implementation contains a vulnerability in how it handles highly compressed data, allowing an attacker to send a small compressed payload that expands to an extremely large size, consuming server memory and causing a denial of service. An unauthenticated attacker can trigger this by sending a specially crafted network request, making this a serious availability risk for services using Thrift.

Technologies: Apache Thrift, thrift (PyPI). Vendors: Apache, PyPI.

Quick answers

Is CVE-2026-41608 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41608 being exploited in the wild.
How severe is CVE-2026-41608?: High severity, with a CVSS score of 7.5, published 27 July 2026.
Which products and versions are affected?: Apache Thrift before 0.24.0; thrift (PyPI) ECOSYSTEM:introduced=0,fixed=0.24.0.
Is there a fix for CVE-2026-41608?: Yes. thrift (PyPI): upgrade to 0.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41608 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41608?: Check whether you run Apache Thrift or thrift (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

thrift (PyPI): upgrade to 0.24.0 or later
```
pip install "thrift>=0.24.0"
```

Technical details

The vulnerability is an improper handling of highly compressed data (CWE-409, data amplification attack). The Apache Thrift Python bindings fail to properly validate or limit the decompression of compressed payloads, allowing an attacker to craft a small network packet containing highly compressed data that decompresses to a very large size when processed by the server. This causes excessive memory consumption and can lead to denial of service. The attack is network-accessible, requires no authentication or user interaction, and can be exploited remotely. The vulnerability affects all versions of Apache Thrift before 0.24.0, which contains the fix. A patch is available by upgrading to version 0.24.0 or later.

Affected products

Apache Thrift before 0.24.0

Identifiers

CVE-2026-41608
GHSA-6pjx-3pjc-mrj8
PYSEC-2026-3925

Timeline

2026-07-27: disclosed
2026-07-27: patched: Version 0.24.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.