CVE-2026-55971
Undergoing Analysis Undergoing Analysis - In Progress

Heap-based Buffer Overflow in Apache Thrift C++ Bindings

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: Apache Software Foundation

Description
Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-55971
EUVD
EUVD-2026-49155

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache thrift to 0.24.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-based buffer overflow vulnerability in Apache Thrift's C++ bindings. A heap-based buffer overflow occurs when a program writes more data to a buffer than it can hold, corrupting adjacent memory. This can lead to crashes, data corruption, or arbitrary code execution.

Detection Guidance

Detection involves checking the Apache Thrift version in use. Commands like 'thrift --version' or inspecting package managers (e.g., 'dpkg -l | grep thrift' for Debian/Ubuntu) can verify if the installed version is before 0.24.0. If so, the system is vulnerable.

Impact Analysis

The vulnerability can cause application crashes, data corruption, or allow attackers to execute arbitrary code on affected systems. Since Apache Thrift is used for cross-language services, systems relying on it for communication may be compromised.

Compliance Impact

This vulnerability is a heap-based buffer overflow in Apache Thrift C++ bindings, which could allow remote attackers to execute arbitrary code or cause denial of service. Such vulnerabilities may lead to unauthorized data access or system compromise, potentially violating GDPR (data protection) and HIPAA (health data security) requirements for safeguarding sensitive information.

Mitigation Strategies

Upgrade Apache Thrift to version 0.24.0 or later to address the heap-based buffer overflow vulnerability in C++ bindings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55971. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart