CVE-2026-48586

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-409

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Thrift	< 0.24.0
Apache Software Foundation	Apache Thrift	< 0.24.0
Apache Software Foundation	Apache Thrift	< 0.24.0
Apache Software Foundation	Apache Thrift	< 0.24.0
Apache Software Foundation	Apache Thrift	< 0.24.0
Apache Software Foundation	Apache Thrift	< 0.24.0

References

https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9Release Notes
https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoqVendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/24/37Mailing List, Third Party Advisory

Timeline

Published: Jul 27, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-485875.3An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip le CVE-2026-485885.3An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache res CVE-2026-485895.4Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, i CVE-2026-48596.4The SP Blog Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'design' attribute of the `wpsbd_post_carouse CVE-2026-485902.1XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vulnerability is assoc CVE-2026-485914.8Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unesc CVE-2026-485925.3Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker subs CVE-2026-485935.9Uncontrolled Resource Consumption vulnerability in oban-bg oban_web ('Elixir.Oban.Web.CronExpr' modules) allows memory exhaustion via unboun CVE-2026-485947.5Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-tesla tesla allows a denial of service via decompre CVE-2026-485955.9Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party origin on cross-origin CVE-2026-485963.7Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-tesla tesla allows HTT CVE-2026-485975.9Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via atom table exhaustion