CVE-2026-48586 is a denial of service vulnerability in Apache Thrift due to improper handling of highly compressed data (data amplification). Remote unauthenticated attackers can send specially crafted compressed data that causes excessive CPU and memory consumption, leading to resource exhaustion and service disruption. This affects the jaeger package included in Red Hat Hardened Images RPMs. The advisory also addresses CVE-2026-55969, but details on this second CVE are not provided. The update includes jaeger version 2.20.0-0.5.hum1 for aarch64 and x86_64 architectures. Red Hat provides an official security advisory (RHSA-2026:46974) with instructions to apply the update.

The vulnerability allows remote attackers to cause denial of service by sending specially crafted highly compressed data, leading to resource exhaustion (CPU and memory) and system unavailability. This impacts the availability of services using vulnerable versions of jaeger in Red Hat Hardened Images. There is no impact on confidentiality or integrity reported. No known exploits are currently active in the wild.

An update to jaeger version 2.20.0-0.5.hum1 is available from Red Hat Hardened Images RPMs. Users should apply this update to remediate the vulnerabilities. No other mitigations or workarounds are specified in the advisory. Patch status is confirmed by the vendor advisory. No action beyond applying the update is indicated.