CVE-2026-49158
CVE-2026-49158 · Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
CVSS 7.5 · High · EPSS 1.0% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
apache thrift
- Versions
- ≥ 0, < 0.24.0: Affected (semver)
Update to 0.24.0
thrift Debian:12
- Versions
- 0.17.0-2
- 0.17.0-3
- 0.17.0-4
- 0.18.1-1
- 0.18.1-2
- 0.19.0-1
- 0.19.0-2
- 0.19.0-2.1
- 0.19.0-2.1~exp1
- 0.19.0-3
- 0.19.0-4
- 0.20.0-1
- 0.22.0-1
- 0.22.0-2
- 0.22.0-3
- 0.22.0-4
- 0.23.0-1
- 0.23.0-2
- 0.23.0-3
- 0.24.0-1
- 0.24.0-2
- 0.24.0-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
thrift Debian:13
- Versions
- 0.19.0-4
- 0.20.0-1
- 0.22.0-1
- 0.22.0-2
- 0.22.0-3
- 0.22.0-4
- 0.23.0-1
- 0.23.0-2
- 0.23.0-3
- 0.24.0-1
- 0.24.0-2
- 0.24.0-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
thrift Debian:14
- Versions
- 0.19.0-4
- 0.20.0-1
- 0.22.0-1
- 0.22.0-2
- 0.22.0-3
- 0.22.0-4
- 0.23.0-1
- 0.23.0-2
- 0.23.0-3
- 0.24.0-1
- Affected ranges
- ECOSYSTEM: < 0.24.0-2
Update to 0.24.0-2
ruby-thrift Ubuntu:20.04:LTS
- Versions
- 0.11.0.0-2
- 0.11.0.0-2build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby-thrift Ubuntu:22.04:LTS
- Versions
- 0.11.0.0-3
- 0.14.0-2
- 0.14.0-2build1
- 0.14.0-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby-thrift Ubuntu:24.04:LTS
- Versions
- 0.16.0-2
- 0.16.0-2build1
- 0.16.0-2build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published