CVE-2026-91135
published 2026-10-02CVE-2026-91135: Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends…
PriorityP356critical9.2CVSS 4.0
AVNACLATPPRNUINVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.46%
39.0th percentile
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size of the frame, and for large frames it also reads past the end of the transform buffer.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform | automation-orchestrator-temporal-rhel9 | — | — |
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
| cryostat | cryostat-storage-rhel9 | — | — |
| grafana | grafana | — | — |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| openshift-logging | logging-loki-rhel9 | — | — |
| openshift4 | cnf-tests-rhel8 | — | — |
| openshift4 | oc-mirror-plugin-rhel9 | — | — |
| openshift4 | ztp-site-generate-rhel8 | — | — |
| rhacm2 | acm-grafana-rhel9 | — | — |
| rhaiis | vllm-cpu-rhel9 | — | — |
| rhaiis | vllm-tpu-rhel9 | — | — |
| rhceph | alloy-rhel10 | — | — |
| rhceph | grafana-rhel10 | — | — |
| rhceph | grafana-rhel9 | — | — |
| rhceph | rhceph-6-dashboard-rhel9 | — | — |
| rhceph | snmp-notifier-rhel10 | — | — |
| rhceph | snmp-notifier-rhel8 | — | — |
| rhceph | snmp-notifier-rhel9 | — | — |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-model-registry-rhel9 | — | — |
| rhosdt | opentelemetry-collector-rhel9 | — | — |
| rhosdt | tempo-jaeger-query-rhel9 | — | — |
| rhosdt | tempo-query-rhel9 | — | — |
CVSS provenance
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat9.2CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
github.com/apache/thrift: Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)
vendor_redhat·2026-10-02·CVSS 9.2
CVE-2026-91135 [CRITICAL] CWE-787 github.com/apache/thrift: Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)
github.com/apache/thrift: Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size of the frame, and for large frames it also reads past the end of the transform buffer.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
A flaw was found in Apache
GHSA
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
ghsa_unreviewed·2026-10-02
CVE-2026-91135 [CRITICAL] CWE-122 Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size of the frame, and for large frames it also reads past the end of the transform buffer.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-91135 golang-github-apache-thrift: Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction) [fedora-all]
bugzilla·2026-10-15·CVSS 9.2
CVE-2026-91135 [CRITICAL] CVE-2026-91135 golang-github-apache-thrift: Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction) [fedora-all]
CVE-2026-91135 golang-github-apache-thrift: Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction) [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that g
Bugzilla
CVE-2026-91135 migrate: Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction) [fedora-all]
bugzilla·2026-10-15·CVSS 9.2
CVE-2026-91135 [CRITICAL] CVE-2026-91135 migrate: Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction) [fedora-all]
CVE-2026-91135 migrate: Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction) [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size o
Bugzilla
CVE-2026-91135 github.com/apache/thrift: Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)
bugzilla·2026-10-02·CVSS 9.2
CVE-2026-91135 [CRITICAL] CVE-2026-91135 github.com/apache/thrift: Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)
CVE-2026-91135 github.com/apache/thrift: Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size of the frame, and for large frames it also reads past the end of the transform buffer.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
2026-10-02
Published