Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-27T11:11:23 thrift: Apache Thrift C++ bindings: Remote code execution via heap-based buffer overflow 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-122

Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

A flaw was found in Apache Thrift C++ bindings. A remote, unauthenticated attacker can exploit a heap-based buffer overflow vulnerability without user interaction. This can lead to arbitrary code execution, allowing the attacker to gain full control over the affected system, compromise data, and cause a denial of service.

This flaw affects the C++ implementation of Apache Thrift, specifically the ZLIB-enabled THeaderTransport (THeaderTransport::untransform()), which is reachable when a Thrift client or server negotiates the Header transport protocol with ZLIB compression enabled over a network connection. Red Hat ships the affected C++ package (thrift) in RHEL AI and in the Fedora/EPEL community distributions, and it is also consumed by AIPCC's PyArrow build pipeline (tracked separately as AIPCC-28667); upgrade to Apache Thrift 0.24.0 or later to remediate. Confirmed usage in RHEL AI 3.4's GPU bootc images and in the AIPCC PyArrow build pipeline is limited to PyArrow's Parquet metadata support, which serializes structs via Thrift's TCompactProtocol directly to an in-memory buffer and does not invoke THeaderTransport. As a result, this usage does not expose the vulnerable code path to network input; it would require local access to a maliciously crafted Parquet file instead. Other Red Hat components that reference Apache Thrift via the Go implementation (github.com/apache/thrift) or the Java Maven artifact (org.apache.thrift:libthrift) depend on independently implemented, separately maintained codebases; the Java bindings do not include the vulnerable ZLIB THeaderTransport code path (and CWE-122 heap corruption does not apply to JVM memory-managed arrays) and are therefore not affected. No mitigation is available other than upgrading to Apache Thrift 0.24.0 or later, which contains the fix. AIPCC's PyArrow build pipeline is tracked separately for remediation under AIPCC-28667. Red Hat Enterprise Linux AI 3.4 for RHEL 9 2026-08-03T00:00:00Z RHSA-2026:49716 thrift-0:0.24.0-1.el9ai Red Hat Enterprise Linux AI 3.5 for RHEL 9 2026-08-03T00:00:00Z RHSA-2026:49715 thrift-0:0.24.0-1.el9ai Red Hat Enterprise Linux AI 3.6 for RHEL 9 2026-08-06T00:00:00Z RHSA-2026:51358 thrift-0:0.24.0-2.el9ai Confidential Compute Attestation Not affected openshift-sandboxed-containers/osc-podvm-payload-rhel9 Red Hat build of Apache Camel 4 for Quarkus 3 Not affected libthrift Red Hat Data Grid 8 Not affected libthrift Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected libthrift Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-modelmesh-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-spark-operator-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift Container Platform 4 Not affected conmon-rs Red Hat OpenShift Container Platform 4 Not affected kata-containers Red Hat OpenShift Update Service Not affected openshift-update-service/openshift-update-service-rhel8 https://www.cve.org/CVERecord?id=CVE-2026-55971 https://nvd.nist.gov/vuln/detail/CVE-2026-55971 https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9 https://lists.apache.org/thread/xjs36m6kjxpmrmzwck636msg3nvoqnmx