Apache Thrift C++: Heap-based buffer overflow in THeaderTransport
Summary
The C++ implementation of Apache Thrift contains a heap-based buffer overflow in THeaderTransport::transform() when the ZLIB transform is enabled for outgoing frames. Data that does not compress, such as content supplied by a remote peer, can grow past the buffer size, so the copy writes beyond the end of the heap buffer and, for large frames, reads past the end of the transform buffer. An attacker who can reach the affected service may be able to crash it or potentially execute code; the CVSS 4.0 base score is 9.2 (Critical). Exploitation depends on the application enabling the ZLIB transform.
Affected
- Apache Thrift (C++), all versions before 0.25.0
- Only applications that enable the ZLIB transform for THeader frames they send
- Distribution packages: check your vendor advisory for exact builds
Fixed in
- Apache Thrift 0.25.0
Workaround
- No vendor-published workaround; upgrading to 0.25.0 is the recommended fix.
- Where the application allows it, disable the ZLIB transform for THeader (not vendor-confirmed).
- Restrict which peers can reach the Thrift service (not vendor-confirmed).
Exploitation
- No public proof-of-concept confirmed at the time of the latest source.
- Not listed in CISA KEV in the same source; recheck the catalog.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- EPSS 0.0046 at the time of the snapshot.
Our recommendation
- Inventory which applications and products bundle C++ Thrift and whether they enable the ZLIB transform.
- Upgrade affected components to Apache Thrift 0.25.0 or later, or install the fixed build from your distribution's advisory.
- Until patched, restrict network access to the Thrift service and do not expose it to the internet.
- Note that upgrading only to 0.24.0 does not fix this CVE, which is a separate issue from CVE-2026-55971.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Thrift mailing list thread 1 lists.apache.org
- Apache Thrift mailing list thread 2 lists.apache.org
- OSV: Apache Thrift affected versions osv.dev
- Vulners: CVE record mirror (NVD) vulners.com
- Vulners: Apache CNA record mirror vulners.com
- TheHackerWire: CVE-2026-91135 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:56.
Original description (NVD)
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size of the frame, and for large frames it also reads past the end of the transform buffer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.