high7.5
CVE-2026-41608
Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability
Impact
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | thrift | < 0.24.0 | 0.24.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Thrift | before 0.24.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-6pjx-3pjc-mrj8
- https://nvd.nist.gov/vuln/detail/CVE-2026-41608
- https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9
- https://lists.apache.org/thread/vwsbcwqdpwdtp8qkjo11ol6rodbfm21f
- http://www.openwall.com/lists/oss-security/2026/07/24/32