CVE-2026-41608: Apache Thrift DOS Vulnerability

CVE-2026-41608 Overview

CVE-2026-41608 is a data amplification vulnerability affecting the Python bindings of Apache Thrift. The flaw is tracked under CWE-409, which covers improper handling of highly compressed data. An unauthenticated remote attacker can send a small, crafted payload that expands into disproportionately large in-memory data, exhausting resources on the receiving service. The issue affects all Apache Thrift releases before 0.24.0. The Apache Thrift project fixed the flaw in version 0.24.0, and users are advised to upgrade.

Critical Impact
A remote, unauthenticated attacker can trigger resource exhaustion in Python-based Apache Thrift services, resulting in denial of service against production RPC endpoints.

Affected Products

Apache Thrift Python bindings, all versions before 0.24.0
Services and applications using Apache Thrift Python client or server libraries
Downstream Python projects depending on thrift as a package

Discovery Timeline

2026-07-27 - CVE-2026-41608 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-41608

Vulnerability Analysis

Apache Thrift is a cross-language RPC framework that serializes structured data over the wire. The Python bindings accept compressed message payloads and decompress them during deserialization. Before version 0.24.0, the Python implementation did not enforce sensible limits on the ratio between compressed input size and decompressed output size. An attacker with network access to a Thrift endpoint can submit a tiny compressed message that expands into a very large decompressed structure. The impact is limited to availability, with confidentiality and integrity unaffected.

Root Cause

The root cause is improper handling of highly compressed data, classified as [CWE-409]. The Python bindings decompress and materialize incoming Thrift messages without bounding the resulting size against the compressed input. This design allows a compression ratio attack, sometimes referred to as a decompression bomb or zip bomb pattern, against any Thrift Python service that accepts compressed transport frames.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker crafts a highly compressible payload, such as a long run of repeated bytes, and submits it to a Thrift Python server. The server decompresses the payload during message parsing, allocating memory proportional to the decompressed size. Repeated or parallel requests amplify the effect, driving the target process into memory exhaustion, garbage collection thrashing, or termination by the operating system out-of-memory killer. See the Apache mailing list advisory and the OpenWall OSS Security discussion for further technical detail.

Detection Methods for CVE-2026-41608

Indicators of Compromise

Sudden spikes in Python process memory consumption on hosts running Thrift servers
Repeated out-of-memory kills or process restarts of Thrift-based services
Inbound Thrift requests with unusually small compressed payloads followed by prolonged server-side processing
Elevated garbage collection time and CPU usage on Thrift endpoints without a matching increase in request volume

Detection Strategies

Inventory Python dependencies across services and flag any use of the thrift package at versions below 0.24.0
Monitor the ratio of inbound payload size to memory allocation growth on Thrift service processes
Alert on abnormal termination of Thrift server processes, particularly signals related to memory pressure
Correlate network traffic to Thrift ports with sudden latency degradation or connection failures

Monitoring Recommendations

Emit per-request metrics for decompressed payload size and reject requests exceeding a defined ceiling
Track resident set size (RSS) of Thrift service processes and alert on rapid growth
Log source IP addresses and request identifiers for messages that trigger decompression errors or size limits
Feed application and host telemetry into a centralized analytics platform so decompression anomalies can be correlated with upstream network sources

How to Mitigate CVE-2026-41608

Immediate Actions Required

Upgrade the Apache Thrift Python bindings to version 0.24.0 or later on all affected services
Restrict network exposure of Thrift endpoints so only trusted clients can reach them
Apply request size limits at load balancers or ingress proxies fronting Thrift services
Rebuild and redeploy container images and virtual environments that pin older thrift versions

Patch Information

The Apache Thrift project fixed CVE-2026-41608 in Apache Thrift 0.24.0. Upgrade guidance and release notes are available in the Apache mailing list announcement and the related Apache thread. Reinstall the package using a pinned requirement such as thrift>=0.24.0 in requirements files, Pipenv, or Poetry configurations.

Workarounds

Disable compressed transports on Thrift servers where feasible until the patched version is deployed
Enforce strict maximum message size limits on Thrift protocol and transport layers
Place Thrift services behind an application-aware proxy that rejects requests with anomalous compression ratios
Apply operating system resource limits, such as cgroup memory caps, to constrain the impact of decompression bombs

bash

# Upgrade Apache Thrift Python bindings to the fixed release
pip install --upgrade "thrift>=0.24.0"

# Verify installed version
python -c "import thrift; print(thrift.__version__)"