Executive brief
Apache Thrift is a widely-used framework for building distributed services and APIs. The Python implementation contains a vulnerability in how it handles highly compressed data, allowing an attacker to send a small compressed payload that expands to an extremely large size, consuming server memory and causing a denial of service. An unauthenticated attacker can trigger this by sending a specially crafted network request, making this a serious availability risk for services using Thrift.
Technical details
The vulnerability is an improper handling of highly compressed data (CWE-409, data amplification attack). The Apache Thrift Python bindings fail to properly validate or limit the decompression of compressed payloads, allowing an attacker to craft a small network packet containing highly compressed data that decompresses to a very large size when processed by the server. This causes excessive memory consumption and can lead to denial of service. The attack is network-accessible, requires no authentication or user interaction, and can be exploited remotely. The vulnerability affects all versions of Apache Thrift before 0.24.0, which contains the fix. A patch is available by upgrading to version 0.24.0 or later.
Affected products
- Apache Thrift before 0.24.0
Timeline
- 2026-07-27: disclosed
- 2026-07-27: patched: Version 0.24.0 released with fix