CVE-2026-48586: Apache Thrift data amplification in TZlibTransport

Executive brief

Apache Thrift, a framework used for cross-language software development and communication, is vulnerable to a data amplification attack. An attacker can send highly compressed data that, when processed, consumes excessive system resources, potentially leading to a complete service outage. This affects multiple programming language bindings including C++, Java, Python, and Go.

Technical details

Apache Thrift versions prior to 0.24.0 are vulnerable to a Data Amplification (CWE-409) attack, specifically within the TZlibTransport decompression component. The vulnerability exists across C++, Java, Python, Go, D, and C/GLib bindings. The root cause is the lack of adequate decompression size limits, allowing a small malicious payload to expand into a massive amount of data upon processing. This is a network-reachable attack requiring no authentication or user interaction, resulting in a high impact on availability (Denial of Service). The issue is resolved in version 0.24.0.

Affected products

• Apache Software Foundation Apache Thrift before 0.24.0

Timeline

• 2026-07-24: disclosed: Initial disclosure on oss-security mailing list
• 2026-07-27: advisory: NVD publication date

References

• https://pypi.python.org/
• https://proxy.golang.org/
• https://repo.maven.apache.org/maven2
• https://conan.io/center
• https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9
• https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq
• http://www.openwall.com/lists/oss-security/2026/07/24/37