Read the docs
TI-2026-65914 Aliases CVE-2026-91135GHSA-3gv9-wqfp-2rf3

Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)

Priority MEDIUM 42CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 fixed, 10 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size of the frame, and for large frames it also reads past the end of the transform buffer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00339 27th percentileScored 2026-11-07
Fix Partial Apache Thrift (Apache Software Foundation): 0.25.0Red Hat: 1 advisoryRed Hat: 1 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Thriftbefore 0.25.00.25.0Patch availableCNA
  • Apache Thrift VendorApache Affected before 0.25.0 Fixed in 0.25.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*——Apache
  • cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:* Versions — — ·Apache

Remediation

  • Fix · CNA Apache Thrift (Apache Software Foundation) Fixed in 0.25.0

Red Hat 1 advisory

  • RHSA-2026:95360 Released 2026-11-04 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-storage-rhel9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache Thrift — lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1

    61 records Highest priority Priority MEDIUM 31 MEDIUM, 30 LOW

    Other records, highest priority first

    • TI-2026-65915 Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elementsPriority MEDIUM 45
    • TI-2026-65974 Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exceptionPriority MEDIUM 44
    • TI-2026-65968 Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)Priority MEDIUM 44
    Show all 61 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Ansible Automation Orchestrator 2026AffectedNo fix yet
Lightspeed CoreAffectedNo fix yet
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 5AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 6AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Cryostat 4 on RHEL 9Fixed RHSA-2026:95360
Not affected: 15 products
  • Confidential Compute Attestation
  • Cryostat 4 on RHEL 9
  • Multicluster Global Hub
  • Red Hat AI Inference Server
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Update Service
  • Red Hat OpenShift distributed tracing 3
  • Red Hat OpenStack Platform 18.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-91135
  2. 2026-10-03 Alias added: GHSA-3gv9-wqfp-2rf3
  3. 2026-10-04 Priority changed: LOW → MEDIUM
  4. 2026-10-13 Affected versions changed · Red Hat
  5. 2026-10-13 CVSS score added · Red Hat
  6. 2026-10-15 Affected versions changed · Red Hat
  7. 2026-10-16 Affected versions changed · Red Hat
  8. 2026-10-20 Affected versions changed · Red Hat
  9. 2026-10-24 Affected versions changed · Red Hat
  10. 2026-10-27 Affected versions changed · Red Hat
  11. 2026-11-05 Fix available: Cryostat 4 on RHEL 9 · Red Hat
  12. 2026-11-06 Fix available: RHSA-2026:95360 · Red Hat

References

Advisory 2

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences