CVE-2026-91135
CriticalCVSS 9.2Summary
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer, and for large frames it also reads past the end of the transform buffer.
Risk Assessment
An attacker could cause memory corruption, potentially leading to arbitrary code execution or disclosure of sensitive information. The vulnerability affects versions before 0.25.0.
Recommendation
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Other vulnerabilities in Apache Thrift
See all- CVE-2026-96990High
Vulnerability involving allocation of resources without limits or throttling in Apache Thrift Erlang bindings. Lack of limits can lead to resource exhaustion. Affects versions before 0.25.0.
- CVE-2026-94651High
Vulnerability in Apache Thrift Java bindings involving improper handling of exceptional conditions and missing release of resources after effective lifetime. Affects versions before 0.25.0.
- CVE-2026-94650High
Uncontrolled recursion vulnerability in Apache Thrift c_glib bindings. Excessive recursion can lead to stack overflow and process crash. Affects versions before 0.25.0.
- CVE-2026-94645High
Vulnerability in Apache Thrift nodejs bindings involving improper validation of specified quantity in input and allocation of resources without limits. Affects versions before 0.25.0.
- CVE-2026-94644High
Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. Lack of limits can lead to resource exhaustion. Affects versions before 0.25.0.
- CVE-2026-94642High
Uncaught exception vulnerability in Apache Thrift PHP bindings. An unhandled exception can lead to unexpected termination of the application. Affects versions before 0.25.0.
- CVE-2026-94633High
Vulnerability in Apache Thrift Dart bindings involving memory allocation with excessive size value and improper handling of length parameter inconsistency. Affects versions before 0.25.0.
- CVE-2026-93926High
Vulnerability in Apache Thrift THeaderTransport involving missing release of memory and resources after effective lifetime. Affects versions before 0.25.0.
- CVE-2026-93925High
A stack-based buffer overflow and incorrect bitwise shift of integer vulnerability exists in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift versions before 0.25.0.
- CVE-2026-91137High
Improper validation of specified quantity in input, allocation of resources without limits or throttling, and excessive iteration vulnerability exists in Apache Thrift PHP bindings. This issue affects Apache Thrift versions before 0.25.0.
Original NVD description (English source)
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size of the frame, and for large frames it also reads past the end of the transform buffer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS