Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport
CVE-2026-41608

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Thrift
Vendor: CVE Published:; 27 July 2026

🔔 Create Apache Vulnerability Alert

What is CVE-2026-41608?

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Affected Version(s)

Apache Thrift 0 < 0.24.0

References

https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb...

vendor-advisory

https://lists.apache.org/thread/vwsbcwqdpwdtp8qkjo11ol6ro...

vendor-advisory

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 27, 2026
Vulnerability Reserved
Apr 21, 2026

CVE-2026-41608 Data

.