CVE-2026-91135
Received Received - Intake

Heap-based Buffer Overflow in Apache Thrift

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: Apache Software Foundation

Description
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size of the frame, and for large frames it also reads past the end of the transform buffer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-91135
EUVD
EUVD-2026-91374

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache thrift to 0.25.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-based buffer overflow in Apache Thrift's C++ THeaderTransport. When ZLIB compression is enabled for sending frames, the transform function copies compressed data into a write buffer without checking if it fits. Non-compressible data, including malicious input, can cause the buffer to overflow during compression, leading to memory corruption. The issue affects Apache Thrift versions before 0.25.0.

Impact Analysis

An attacker could exploit this to execute arbitrary code, crash the application, or gain unauthorized access to sensitive data. The impact depends on the application's use of Apache Thrift and the privileges of the affected process. Large frames increase the risk of successful exploitation.

Compliance Impact

This vulnerability could lead to data breaches, unauthorized access, or service disruptions, which may violate GDPR (data protection), HIPAA (health data security), or other compliance requirements. Organizations must address it to maintain regulatory compliance and protect sensitive data.

Mitigation Strategies

Upgrade Apache Thrift to version 0.25.0 or later to fix the heap-based buffer overflow issue in THeaderTransport.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91135. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart