Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() (CVE-2026-55971)
A heap-based buffer overflow vulnerability exists in the Apache Thrift C++ bindings within the THeaderTransport::untransform() function. This issue affects versions of Apache Thrift prior to 0.24.0. The vulnerability has been assigned CVE-2026-55971 and is considered critical in severity. Red Hat has released updated packages as part of Red Hat Enterprise Linux AI 3.4 and 3.5 to address this issue. Users are strongly advised to upgrade to version 0.24.0 or later to remediate the vulnerability.
AI Analysis
Technical Summary
CVE-2026-55971 is a heap-based buffer overflow vulnerability in the Apache Thrift C++ bindings, specifically in the THeaderTransport::untransform() function. This vulnerability affects all Apache Thrift versions before 0.24.0. The flaw could allow an attacker to cause a buffer overflow condition, potentially leading to memory corruption. Red Hat Product Security has issued advisories (RHSA-2026:49715 and RHSA-2026:49716) addressing this vulnerability in their Red Hat Enterprise Linux AI 3.4 and 3.5 releases by updating the thrift packages to version 0.24.0. The advisories recommend upgrading to this fixed version to mitigate the issue.
Potential Impact
The vulnerability is a heap-based buffer overflow, which can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service. The severity is rated as critical by the source. No known exploits in the wild have been reported at this time. The impact is limited to affected versions of Apache Thrift C++ bindings prior to 0.24.0.
Mitigation Recommendations
A patch is available and users should upgrade Apache Thrift to version 0.24.0 or later. Red Hat has released updated thrift packages for Red Hat Enterprise Linux AI 3.4 and 3.5 that include this fix. Users should apply these updates as per the Red Hat advisories RHSA-2026:49715 and RHSA-2026:49716. Prior to applying these updates, ensure all previously released errata relevant to the system have been applied. No additional mitigation steps are indicated by the vendor.
Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() (CVE-2026-55971)
Description
A heap-based buffer overflow vulnerability exists in the Apache Thrift C++ bindings within the THeaderTransport::untransform() function. This issue affects versions of Apache Thrift prior to 0.24.0. The vulnerability has been assigned CVE-2026-55971 and is considered critical in severity. Red Hat has released updated packages as part of Red Hat Enterprise Linux AI 3.4 and 3.5 to address this issue. Users are strongly advised to upgrade to version 0.24.0 or later to remediate the vulnerability.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-55971 is a heap-based buffer overflow vulnerability in the Apache Thrift C++ bindings, specifically in the THeaderTransport::untransform() function. This vulnerability affects all Apache Thrift versions before 0.24.0. The flaw could allow an attacker to cause a buffer overflow condition, potentially leading to memory corruption. Red Hat Product Security has issued advisories (RHSA-2026:49715 and RHSA-2026:49716) addressing this vulnerability in their Red Hat Enterprise Linux AI 3.4 and 3.5 releases by updating the thrift packages to version 0.24.0. The advisories recommend upgrading to this fixed version to mitigate the issue.
Potential Impact
The vulnerability is a heap-based buffer overflow, which can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service. The severity is rated as critical by the source. No known exploits in the wild have been reported at this time. The impact is limited to affected versions of Apache Thrift C++ bindings prior to 0.24.0.
Mitigation Recommendations
A patch is available and users should upgrade Apache Thrift to version 0.24.0 or later. Red Hat has released updated thrift packages for Red Hat Enterprise Linux AI 3.4 and 3.5 that include this fix. Users should apply these updates as per the Red Hat advisories RHSA-2026:49715 and RHSA-2026:49716. Prior to applying these updates, ensure all previously released errata relevant to the system have been applied. No additional mitigation steps are indicated by the vendor.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:49715
- Cve Count
- 1
- State
- PUBLISHED
Threat ID: 6a710664bf32cb7a34394732
Added to database: 08/03/2026, 21:21:40 UTC
Last enriched: 09/08/2026, 15:10:02 UTC
Last updated: 09/17/2026, 22:01:36 UTC
Views: 24
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.