< Back

CVE-2026-48586

Updated on 27 Jul 2026

Severity

7.5 High severity

Details

CVSS score
7.5
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Details

Affected product:
Apache Hive , Apache Log4j , Apache Solr , Apache Spark , Wildfly , accumulo , alluxio , avro , camel , druid , flume , hbase , incubator-retired-htrace , infinispan , jaeger-analytics-java , jaeger-client-java , jena , kite , logging-flume , logging-flume-irc , opencensus-java , org.apache.jena:jena-tdb , org.tachyonproject:tachyon-common , org.tachyonproject:tachyon-underfs-hdfs , pulsar , tachyon , thrift , tinkerpop , zipkin-reporter-java
Affected packages:
libthrift @ 0.7.0 (+3395 more)