Full Report
Apache security advisory (AV26-749)
Analysis Summary
# Vulnerability: Multiple Flaws in Apache Thrift (AV26-749)
## CVE Details
- **CVE ID:** CVE-2026-48586, CVE-2026-49158, CVE-2026-55969, CVE-2026-58023
- **CVSS Score:** Not explicitly listed in advisory (Assessed as Medium to High based on flaw types)
- **CWE:**
- CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
- CWE-190 (Integer Overflow or Wraparound)
- CWE-400 (Uncontrolled Resource Consumption - "Decompression Bomb")
## Affected Systems
- **Products:** Apache Thrift
- **Versions:** All versions prior to 0.24.0
- **Configurations:**
- **CVE-2026-48586:** Implementations using `TZlibTransport`.
- **CVE-2026-49158:** Ruby implementations using `THeaderTransport`.
- **CVE-2026-55969:** Implementations relying on `TProtocol::checkReadBytesAvailable()`.
- **CVE-2026-58023:** C_glib library transport implementations.
## Vulnerability Description
Apache Thrift is affected by four distinct security flaws:
1. **CVE-2026-48586 (Decompression Limit):** A flaw in `TZlibTransport` where the lack of a decompression size limit can lead to resource exhaustion.
2. **CVE-2026-49158 (Ruby ZLIB Bomb):** The Ruby implementation of `THeaderTransport` is vulnerable to a "Decompression Bomb," where specially crafted ZLIB data expands to a massive size upon processing.
3. **CVE-2026-55969 (Integer Overflow):** An integer overflow exists in the `checkReadBytesAvailable()` function within `TProtocol`, potentially leading to incorrect memory allocation or logic bypass.
4. **CVE-2026-58023 (Heap OOB Read):** A heap out-of-bounds read vulnerability in the `c_glib` transport's leftover-bytes path, which could lead to information disclosure or application crashes.
## Exploitation
- **Status:** Not exploited (No known active exploitation reported at the time of advisory)
- **Complexity:** Medium
- **Attack Vector:** Network
## Impact
- **Confidentiality:** Low to Medium (Possible information disclosure via OOB Read)
- **Integrity:** Medium
- **Availability:** High (Denial of Service via decompression bombs and resource exhaustion)
## Remediation
### Patches
- **Apache Thrift 0.24.0:** Users are strongly encouraged to upgrade to version 0.24.0 or later to resolve these vulnerabilities.
### Workarounds
- Limit the size of incoming network packets at the firewall or proxy level.
- Disable `TZlibTransport` or `THeaderTransport` if they are not strictly required by your application architecture.
## Detection
- **Indicators of Compromise:** Monitor for unusual spikes in memory or CPU usage on servers running Thrift (indicative of decompression bombs).
- **Detection Methods:** Utilize static analysis security testing (SAST) to identify vulnerable versions of the Thrift library in your dependency tree.
## References
- hXXps[://]lists[.]apache[.]org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq
- hXXps[://]lists[.]apache[.]org/thread/fmjl8l415tj9zwlob8v2dr5hq1d0hts7
- hXXps[://]lists[.]apache[.]org/thread/xmkgd107k795hyrg5kf97mny30sgl5bo
- hXXps[://]lists[.]apache[.]org/thread/z2myopbovxngfvchdz8hddots9p5ffbt
- hXXps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/apache-security-advisory-av26-749