CVE-2026-55971
Description
A flaw was found in Apache Thrift C++ bindings. A remote, unauthenticated attacker can exploit a heap-based buffer overflow vulnerability without user interaction. This can lead to arbitrary code execution, allowing the attacker to gain full control over the affected system, compromise data, and cause a denial of service.
Statement
This flaw affects the C++ implementation of Apache Thrift, specifically the ZLIB-enabled THeaderTransport (THeaderTransport::untransform()), which is reachable when a Thrift client or server negotiates the Header transport protocol with ZLIB compression enabled over a network connection. Red Hat ships the affected C++ package (thrift) in RHEL AI and in the Fedora/EPEL community distributions, and it is also consumed by AIPCC's PyArrow build pipeline (tracked separately as AIPCC-28667); upgrade to Apache Thrift 0.24.0 or later to remediate.
Confirmed usage in RHEL AI 3.4's GPU bootc images and in the AIPCC PyArrow build pipeline is limited to PyArrow's Parquet metadata support, which serializes structs via Thrift's TCompactProtocol directly to an in-memory buffer and does not invoke THeaderTransport. As a result, this usage does not expose the vulnerable code path to network input; it would require local access to a maliciously crafted Parquet file instead.
Other Red Hat components that reference Apache Thrift via the Go implementation (github.com/apache/thrift) or the Java Maven artifact (org.apache.thrift:libthrift) depend on independently implemented, separately maintained codebases; the Java bindings do not include the vulnerable ZLIB THeaderTransport code path (and CWE-122 heap corruption does not apply to JVM memory-managed arrays) and are therefore not affected.
Mitigation
No mitigation is available other than upgrading to Apache Thrift 0.24.0 or later, which contains the fix. AIPCC's PyArrow build pipeline is tracked separately for remediation under AIPCC-28667.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.4 | 9.8 | N/A |
| Attack Vector | Local | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | High | High | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
Attack Vector revised from Network to Local. Confirmed shipped usage of thrift (C++) in RHEL AI 3.4 GPU bootc images and AIPCC's PyArrow build pipeline is limited to PyArrow's Parquet metadata support (Thrift TCompactProtocol struct serialization only), which does not invoke the vulnerable THeaderTransport code path. No live network-facing Thrift RPC service using THeaderTransport has been identified in any Red Hat product to date. Pending IC review.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Integrity,Confidentiality,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Modify Memory
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. Besides important user data, heap-based overflows can be used to overwrite function pointers that may be living in memory, pointing it to the attacker's code. Even in applications that do not explicitly use function pointers, the run-time will usually leave many in memory. For example, object methods in C++ are generally implemented using function pointers. Even in C programs, there is often a global offset table used by the underlying runtime.
Integrity,Confidentiality,Availability,Access Control,Other
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Other
When the consequence is arbitrary code execution, this can often be used to subvert any other security service.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
