CVE-2026-48586
Undergoing Analysis Undergoing Analysis - In Progress

Data Amplification in Apache Thrift Bindings

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: Apache Software Foundation

Description
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-48586
EUVD
EUVD-2026-49150

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache thrift to 0.24.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48586 is an improper handling of highly compressed data vulnerability in Apache Thrift affecting multiple language bindings (C++, Java, Python, Go, D, and C/GLib) before version 0.24.0. It involves a data amplification attack through the TZlibTransport decompression mechanism, where specially crafted compressed data could cause excessive resource consumption.

Detection Guidance

To detect this vulnerability, check the version of Apache Thrift installed on your system. If it is before 0.24.0, the system is vulnerable. Use commands like 'thrift --version' or check package managers (e.g., 'apt list --installed | grep thrift' for Debian-based systems).

Monitor network traffic for unusually high data amplification or resource consumption, particularly involving TZlibTransport decompression. Look for patterns of compressed data being processed by Thrift services.

Impact Analysis

This vulnerability could allow an attacker to cause excessive resource consumption by sending specially crafted compressed data, potentially leading to denial-of-service conditions or degraded system performance.

Compliance Impact

This vulnerability could lead to excessive resource consumption via data amplification, potentially causing denial-of-service conditions. Such disruptions may impact data availability and integrity, which are critical under GDPR and HIPAA. However, the provided context does not explicitly link this issue to compliance requirements.

Mitigation Strategies

Immediately upgrade Apache Thrift to version 0.24.0 or later. This is the primary mitigation step to address the improper handling of compressed data. Follow standard upgrade procedures for your system or environment.

If upgrading is not immediately possible, consider disabling or restricting access to Thrift services handling compressed data until the upgrade is completed. Implement network-level controls to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48586. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart