CVE-2026-49158 HIGH

CVE-2026-49158: Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb

Vendor Apache Software Foundation
Product Apache Thrift
Weakness CWE-409
Published July 27, 2026
Last update July 27, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Key dates

02Disclosure timeline

July 27, 2026 CVE published
July 27, 2026 Record updated