thrift: Apache Thrift Python bindings: Denial of Service via data amplification

🗓️ 03 Aug 2026 23:43:03Reported by RedHatType

redhat🔗 access.redhat.com👁 3 Views

Apache Thrift Python bindings suffer a DoS via data amplification from crafted compressed input.

Reporter	Title	Published	Views	Family All 26
ATTACKERKB	CVE-2026-41608	27 Jul 202610:53	–	attackerkb
AlpineLinux	CVE-2026-41608	27 Jul 202610:53	–	alpinelinux
CBLMariner	CVE-2026-41608 affecting package thrift for versions less than 0.24.0-1	1 Aug 202603:56	–	cbl_mariner
Circl	CVE-2026-41608	24 Jul 202623:32	–	circl
CVE	CVE-2026-41608	27 Jul 202610:53	–	cve
Cvelist	CVE-2026-41608 Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport	27 Jul 202610:53	–	cvelist
Debian CVE	CVE-2026-41608	27 Jul 202610:53	–	debiancve
EUVD	EUVD-2026-49145	27 Jul 202610:53	–	euvd
Microsoft CVE	Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport	7 Aug 202608:20	–	mscve
NVD	CVE-2026-41608	27 Jul 202612:16	–	nvd

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	noarch	perl-thrift	0.24.0-0.1.hum1	perl-thrift-0.24.0-0.1.hum1.noarch.rpm
Red Hat Hardened Images	any	aarch64	python3-thrift	0.24.0-0.1.hum1	python3-thrift-0.24.0-0.1.hum1.aarch64.rpm
Red Hat Hardened Images	any	x86_64	python3-thrift	0.24.0-0.1.hum1	python3-thrift-0.24.0-0.1.hum1.x86_64.rpm

Source	Link
openwall	www.openwall.com/lists/oss-security/2026/07/24/32
access	www.access.redhat.com/security/cve/CVE-2026-41608
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
lists	www.lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9
lists	www.lists.apache.org/thread/vwsbcwqdpwdtp8qkjo11ol6rodbfm21f
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41608
cve	www.cve.org/CVERecord

18 Aug 2026 23:40Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.17.5

EPSS0.01097

SSVC

Apache Thrift Denial of Service Data Amplification Python Bindings Resource Exhaustion Compressed Input