CVE-2026-91135: Apache Thrift Buffer Overflow Vulnerability

CVE-2026-91135 Overview

CVE-2026-91135 is a heap-based buffer overflow [CWE-122] in the Apache Thrift C++ THeaderTransport implementation. The flaw affects applications that enable the ZLIB transform for outbound frames. When THeaderTransport::transform() compresses a frame, it copies the compressed output into the write buffer without validating that the result fits. Attacker-controlled data that fails to compress grows during the transform, writing past the end of the heap buffer. Large frames also trigger out-of-bounds reads from the transform buffer. Apache Thrift versions prior to 0.25.0 are affected, and the project has released 0.25.0 to address the issue.

Critical Impact
Remote attackers can trigger a heap-based buffer overflow in Apache Thrift C++ services using ZLIB transform, potentially leading to memory corruption and remote code execution.

Affected Products

Apache Thrift C++ library versions before 0.25.0
Applications using THeaderTransport with the ZLIB transform enabled
Services built on the Apache Thrift C++ runtime that process remote peer data

Discovery Timeline

2026-10-02 - CVE-2026-91135 published to the National Vulnerability Database (NVD)
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-91135

Vulnerability Analysis

The vulnerability resides in THeaderTransport::transform(), the function responsible for applying frame transforms such as ZLIB compression in the Apache Thrift C++ transport layer. When ZLIB compression runs on a frame whose contents do not compress well, such as random or already-compressed data supplied by a remote peer, the compressed output can exceed the size of the original input. The function copies this compressed data into the write buffer without first verifying that the destination buffer is large enough. The write therefore extends past the end of the heap allocation. For large frames the code additionally reads past the end of the transform buffer, exposing adjacent heap memory to the compression routine.

Root Cause

The root cause is a missing bounds check on the destination write buffer before the compressed frame is copied. The implementation assumes the compressed output will be smaller than the input, which is not guaranteed by the ZLIB specification. Non-compressible inputs expand slightly during compression due to deflate overhead, and this overrun grows with frame size.

Attack Vector

The vulnerability is reachable over the network. An attacker who can send frames to a Thrift C++ service that enables the ZLIB transform for outbound traffic can influence the data flowing through the transform. By submitting high-entropy or crafted payloads, the attacker triggers compressed output that overruns the heap write buffer. Successful exploitation corrupts heap metadata and adjacent allocations, which can escalate to remote code execution in the service process. No authentication is required.

No verified public proof-of-concept code is available at the time of publication. See the Apache Security Thread Update and the Apache Discussion on Vulnerability for technical details.

Detection Methods for CVE-2026-91135

Indicators of Compromise

Unexpected crashes or segmentation faults in Thrift C++ server processes that use THeaderTransport
Heap corruption signatures in core dumps referencing THeaderTransport::transform frames
Abnormally large or high-entropy inbound frames preceding service instability

Detection Strategies

Inventory Thrift C++ services and identify any that enable the ZLIB transform on outbound frames
Enable AddressSanitizer or heap guard pages in non-production builds to surface the overflow during fuzzing
Monitor for repeated process restarts or watchdog restarts on Thrift-based services

Monitoring Recommendations

Alert on anomalous crash rates or memory faults in processes linking the Apache Thrift C++ library
Capture and inspect frame-size distributions on Thrift endpoints exposed to untrusted peers
Log and review ZLIB transform usage during configuration audits of internal RPC services

How to Mitigate CVE-2026-91135

Immediate Actions Required

Upgrade the Apache Thrift C++ library to version 0.25.0 or later across all affected services
Identify services that enable the ZLIB transform and prioritize them for patching
Restrict network exposure of vulnerable Thrift endpoints to trusted peers until patched

Patch Information

Apache has released Apache Thrift 0.25.0, which fixes the missing bounds check in THeaderTransport::transform(). Rebuild and redeploy any C++ applications that statically or dynamically link the Thrift runtime. Refer to the Apache Security Thread Update for release details.

Workarounds

Disable the ZLIB transform on outbound frames where feasible until the upgrade is complete
Place vulnerable services behind authenticated gateways to limit untrusted frame delivery
Apply network-level filtering to drop traffic from untrusted sources targeting Thrift ports

bash

# Verify installed Apache Thrift version on build hosts
thrift --version

# Pin the patched version in build systems (example: vcpkg)
vcpkg install thrift@0.25.0