CVE-2026-66054
published 2026-10-02CVE-2026-66054: Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++…
PriorityP338medium6.9CVSS 4.0
AVNACLATNPRNUINVCNVINVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.28%
20.0th percentile
Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++ bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
CVSS provenance
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Thrift THeaderTransport input validation (EUVD-2026-91630)
vuldb·2026-10-04·CVSS 6.9
CVE-2026-66054 [MEDIUM] Apache Thrift THeaderTransport input validation (EUVD-2026-91630)
A vulnerability was found in Apache Thrift and classified as problematic. This issue affects some unknown processing of the component THeaderTransport. The manipulation results in improper input validation.
This vulnerability was named CVE-2026-66054. The attack may be performed from remote. There is no available exploit.
GHSA
Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++ bindings.
ghsa_unreviewed·2026-10-02
CVE-2026-66054 [MEDIUM] CWE-409 Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++ bindings.
Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++ bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Red Hat
thrift: thrift: Denial of Service via improper handling of compressed data
vendor_redhat·2026-10-02·CVSS 6.9
CVE-2026-66054 [MEDIUM] CWE-409 thrift: thrift: Denial of Service via improper handling of compressed data
thrift: thrift: Denial of Service via improper handling of compressed data
A flaw was found in the Apache Thrift C++ bindings. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by sending specially crafted, highly compressed data payloads. Because the software does not properly restrict resource allocation during decompression, processing these payloads can exhaust system resources and render the service unavailable.
Package: thrift (Red Hat Ceph Storage 7) - Affected
Package: thrift (Red Hat Ceph Storage 8) - Affected
Package: thrift (Red Hat Ceph Storage 9) - Affected
Package: thrift (Red Hat Enterprise Linux AI (RHEL AI) 3) - Affected
No detection rules found.
No public exploits indexed.
2026-10-02
Published