Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-27T11:02:54 thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-409

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data (also known as data amplification), allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted, highly compressed data. The affected component fails to properly manage the expansion of this data, leading to resource exhaustion and system unavailability.

This Important vulnerability in Apache Thrift's handling of highly compressed data can lead to a denial of service. Remote, unauthenticated attackers could exploit this flaw by sending specially crafted compressed data, causing excessive resource consumption and disrupting the availability of services utilizing vulnerable Thrift bindings in Red Hat products. Red Hat Hardened Images 2026-07-22T00:00:00Z RHSA-2026:43581 opentelemetry-collector-contrib-main-0.157.0-0.1.hum1 Red Hat Hardened Images 2026-07-22T00:00:00Z RHSA-2026:43799 opentelemetry-collector-main-0.157.0-0.1.hum1 Red Hat Hardened Images 2026-07-25T00:00:00Z RHSA-2026:45780 loki3-7-main-3.7.4-0.1.hum1 Red Hat Hardened Images 2026-07-27T00:00:00Z RHSA-2026:46931 jaeger-main-2.20.0-0.4.hum1 Red Hat Hardened Images 2026-07-27T00:00:00Z RHSA-2026:46974 jaeger-main-2.20.0-0.5.hum1 Red Hat Hardened Images 2026-07-27T00:00:00Z RHSA-2026:46987 tempo2-10-main-2.10.7-0.2.hum1 Red Hat Hardened Images 2026-07-27T00:00:00Z RHSA-2026:46989 tempo3-0-main-3.0.2-0.2.hum1 Confidential Compute Attestation Affected openshift-sandboxed-containers/osc-podvm-payload-rhel9 Cryostat 4 Affected cryostat/cryostat-storage-rhel9 Multicluster Global Hub Affected multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/acm-grafana-rhel9 Red Hat AI Inference Server Affected rhaii/model-opt-cuda-rhel9 Red Hat AI Inference Server Affected rhaiis/model-opt-cuda-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-cpu-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-cuda-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-neuron-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-rocm-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-spyre-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-tpu-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-cpu-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-cuda-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-gaudi-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-neuron-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-rocm-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-spyre-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-tpu-rhel9 Red Hat build of Apache Camel 4 for Quarkus 3 Affected libthrift Red Hat Ceph Storage 5 Affected rhceph/snmp-notifier-rhel8 Red Hat Ceph Storage 6 Affected rhceph/rhceph-6-dashboard-rhel9 Red Hat Ceph Storage 6 Affected rhceph/snmp-notifier-rhel9 Red Hat Ceph Storage 7 Affected rhceph/grafana-rhel9 Red Hat Ceph Storage 7 Affected rhceph/snmp-notifier-rhel9 Red Hat Ceph Storage 8 Affected rhceph/grafana-rhel9 Red Hat Ceph Storage 8 Affected rhceph/snmp-notifier-rhel9 Red Hat Ceph Storage 9 Affected rhceph/alloy-rhel10 Red Hat Ceph Storage 9 Affected rhceph/grafana-rhel10 Red Hat Ceph Storage 9 Affected rhceph/snmp-notifier-rhel10 Red Hat Connectivity Link 1 Affected rhcl-1/authorino-rhel9 Red Hat Data Grid 8 Not affected libthrift Red Hat Enterprise Linux AI (RHEL AI) 3 Affected thrift Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected libthrift Red Hat OpenShift AI (RHOAI) Affected rhai/base-image-cpu-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhai/base-image-cuda-12.9-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhai/base-image-cuda-13.0-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhai/base-image-gaudi-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhai/base-image-neuron-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhai/base-image-rocm-6.4-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhai/base-image-rocm-7.0-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhai/base-image-rocm-7.1-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhai/base-image-spyre-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhai/base-image-tpu-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-automl-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-kserve-autogluon-server-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-llama-stack-core-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-llm-d-kv-cache-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mlserver-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-modelmesh-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-model-registry-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-spark-operator-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift Container Platform 4 Not affected conmon-rs Red Hat OpenShift Container Platform 4 Affected kata-containers Red Hat OpenShift Container Platform 4 Affected openshift4/cnf-tests-rhel8 Red Hat OpenShift Container Platform 4 Not affected openshift4/oc-mirror-plugin-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ztp-site-generate-rhel8 Red Hat OpenShift distributed tracing 3 Affected rhosdt/opentelemetry-collector-rhel9 Red Hat OpenShift distributed tracing 3 Affected rhosdt/tempo-jaeger-query-rhel9 Red Hat OpenShift distributed tracing 3 Affected rhosdt/tempo-query-rhel9 Red Hat OpenShift distributed tracing 3 Affected rhosdt/tempo-rhel9 Red Hat OpenShift Update Service Not affected openshift-update-service/openshift-update-service-rhel8 Red Hat OpenStack Platform 18.0 Affected rhoso-operators/openstack-operator-bundle https://www.cve.org/CVERecord?id=CVE-2026-48586 https://nvd.nist.gov/vuln/detail/CVE-2026-48586 http://www.openwall.com/lists/oss-security/2026/07/24/37 https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9 https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq