> CVE-2026-41608

« BACK_TO_HOME
PUBLISHED
2026-07-27 12:16
MODIFIED
2026-07-27 12:16
EPSS (Prob. Exploit)
1.03%
Top 36.6%
DATA SOURCES:
NVD 🔗 2026-07-27 RED HAT 🔗 2026-08-09 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-05 OSV 🔗 2026-11-02 MSRC 🔗 2026-11-02

> DESCRIPTION

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-409

> CWE DETAILED DESCRIPTIONS

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) - The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Important

> GITHUB SECURITY ADVISORY

GHSA-6pjx-3pjc-mrj8 HIGH

Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability

AFFECTED PACKAGES:
PIP / thrift
< 0.24.0
Fixed in: 0.24.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport

AFFECTED PACKAGES:
Unknown / Unknown
1 versions affected
ALIASES:
BIT-thrift-2026-41608, GHSA-6pjx-3pjc-mrj8, PYSEC-2026-3925

> HISTORIQUE DES MODIFICATIONS

Première apparition
27/07/2026 12:16
Source: NVD
📊 ENRICHISSEMENT 01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) - The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a lar...
Nouvelle valeur:
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) - The product does not handle or incorrectly handles a compressed input with a very high compression ratio t...
📊 ENRICHISSEMENT 09/08/2026 05:02
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
{ "severity_scale": null, "threat_severity": "Important" }
Nouvelle valeur:
{ "threat_severity": "Important", "severity_scale": null }
📊 ENRICHISSEMENT 02/08/2026 05:02
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Important", "severity_scale": null }
📊 ENRICHISSEMENT 02/08/2026 05:02
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 01/08/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) - The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a lar...
Total des modifications: 5 Dernière mise à jour: 4 days ago

> REFERENCES

https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9
https://lists.apache.org/thread/vwsbcwqdpwdtp8qkjo11ol6rodbfm21f
http://www.openwall.com/lists/oss-security/2026/07/24/32
« BACK_TO_HOME