Apache Thrift: Memory leak in C++ THeaderTransport untransform
Summary
Apache Thrift before 0.25.0 contains a missing release of memory and resources after their effective lifetime in THeaderTransport. According to the official CVE record, the C++ function untransform() leaks the zlib stream on an error path. A remote attacker who can send crafted data to a network-reachable Thrift C++ service may exhaust memory and cause a denial of service, without authentication.
Affected
- Apache Thrift before 0.25.0 (per CVE record; the C++ implementation is the component named in the record)
- Other Thrift bindings were not the subject of this CVE; check the vendor advisory for details
Fixed in
- Apache Thrift 0.25.0 (released 30 September 2026)
- Check your distribution's tracker for the exact fixed package build
Workaround
- Unknown. No vendor workaround is documented; upgrading is the fix.
- If you cannot upgrade yet, restrict which clients can reach Thrift C++ services and monitor memory usage of those processes.
Exploitation
- Not known to be exploited in the wild.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Not in the CISA KEV catalogue. No public proof of concept known.
Our recommendation
- Ask software vendors and developers whether any product you use is built on Thrift C++ and accepts data from untrusted peers.
- Confirm the installed Thrift version and upgrade to 0.25.0 or a fixed distribution package.
- Upgrading also covers CVE-2026-91135 and CVE-2026-93925 in the same release.
- Monitor memory usage of exposed services.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Thrift mailing list thread (CVE reference) lists.apache.org
- Apache Thrift mailing list thread (CVE reference) lists.apache.org
- OSV: Apache Thrift CVE-2026-93926 record osv.dev
- OpenCVE: CVE-2026-93926 app.opencve.io
- Linux Security: Apache Thrift 0.25.0 release linuxsecurity.com
- Vulners: CVE-2026-93926 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:06.
Original description (NVD)
Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.