CVE-2026-49158
Received Received - Intake

Improper Data Handling in Apache Thrift Ruby Bindings

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: Apache Software Foundation

Description
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-49158
EUVD
EUVD-2026-49151

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache thrift to 0.24.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-49158 is an improper handling of highly compressed data vulnerability in Apache Thrift's Ruby bindings. It involves a data amplification flaw in the THeaderTransport ZLIB decompression mechanism that allows attackers to send maliciously compressed data, causing excessive resource consumption.

Detection Guidance

Detection involves checking Apache Thrift Ruby bindings versions and monitoring for unusual resource consumption during data decompression. Verify installed versions with commands like 'gem list thrift' or 'bundle show thrift'. Inspect network traffic for malformed or excessively compressed ZLIB data in THeaderTransport headers.

Impact Analysis

This vulnerability could allow attackers to consume excessive system resources by sending specially crafted compressed data, potentially leading to denial of service conditions or degraded performance on affected systems.

Compliance Impact

The vulnerability involves improper handling of highly compressed data, which could lead to excessive resource consumption. While this may indirectly impact compliance by causing system instability or denial of service, the provided context does not specify direct effects on GDPR or HIPAA compliance.

Mitigation Strategies

Upgrade Apache Thrift to version 0.24.0 or later to address the improper handling of highly compressed data vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49158. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart