CVE-2026-91135

A flaw was found in Apache Thrift. A remote attacker can exploit a heap-based buffer overflow in the C++ transport component to achieve arbitrary code execution or cause a Denial of Service (DoS) through an application crash. The vulnerability occurs when an application enables compression transforms on outbound message frames and processes incompressible input provided by an untrusted peer. When the data expands during compression, it is copied into a memory buffer without adequate boundary validation, resulting in data being written outside the allocated memory limits.

This vulnerability is rated as Moderate impact because successful exploitation requires non-default transport configuration and specific payload characteristics to trigger memory corruption over the network. The issue specifically resides within the C++ implementation of Apache Thrift when outbound frame compression using ZLIB is explicitly activated. Deployments utilizing default framing mechanisms or non-C++ bindings do not encounter this boundary checking failure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.