CVE-2026-94636

Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up

View on CVE.org
Published Oct 2, 2026 CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Description
Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings.



This issue affects Apache Thrift: before 0.25.0.



Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Analysis

AI-generated

Technical impact

Apache Thrift's TZlibTransport incorrectly enforces its decompressed-size limit once the limit is exactly reached, allowing a malicious client to deliver a highly compressed payload that bypasses the size check and forces the server to decompress data larger than intended. This leads to excessive resource consumption and can crash the service, representing a high-impact denial of service.

Affected Systems

The flaw exists in all releases of Apache Thrift before version 0.25.0. Users running the Python bindings of Thrift with TZlibTransport in these older versions are vulnerable and should verify their installation against the specific pre‑0.25.0 releases.

Risk and Exploitability

The CVSS score of 8.2 signals high severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, yet it remains exploitable from a network-facing Thrift service. An attacker can send a crafted compressed packet to trigger memory exhaustion or a crash; however, no public exploits have been reported to date.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Thrift to version 0.25.0 or newer to obtain the fixed transport implementation, which addresses the data amplification issue (CWE‑1284), improper argument usage (CWE‑409), and input validation (CWE‑628).
  • Restrict external access to the Thrift service and apply network-level input filtering to limit the size of incoming compressed payloads, mitigating potential data amplification (CWE‑1284).
  • Enforce strict validation of compressed payload sizes and function arguments in the application logic to guard against incorrect usage (CWE‑409) and ensure that no unwanted data amplification occurs (CWE‑1284, CWE‑628).

Generated by OpenCVE AI on October 2, 2026 at 14:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Apache
Apache thrift
Vendors & Products Apache
Apache thrift
Type Values Removed Values Added
Description Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Title Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up
Weaknesses CWE-1284
CWE-409
CWE-628
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-1284

    Improper Validation of Specified Quantity in Input

  • CWE-409

    Improper Handling of Highly Compressed Data (Data Amplification)

  • CWE-628

    Function Call with Incorrectly Specified Arguments

Sources

Status
PUBLISHED
Assigner
apache
Published
Updated
Oct 2, 2026, 5:32 PM
Reserved
Sep 21, 2026, 10:41 PM

View source JSON

Updated
Oct 2, 2026, 5:32 PM

JSON

Status
Deferred
Published
Oct 2, 2026, 12:17 PM
Modified
Oct 2, 2026, 6:17 PM

View source JSON

No data.

Updated
Oct 2, 2026, 4:00 PM

JSON