Improper Handling of Highly Compressed Data (Data Amplification) Affecting org.apache.thrift:libthrift package, versions [,0.24.0)

org.apache.thrift:libthrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the TZlibTransport read paths in the C++, Java, Python, and Go bindings. An attacker can exhaust memory or trigger a denial of service by sending a small zlib-compressed payload that expands beyond the transport’s intended message-size limits during decompression. The vulnerable code reads decompressed bytes without consistently counting them against the configured maximum message size, so repeated reads through TZlibTransport can keep accepting output from a highly compressed stream even after the limit should have been exceeded. This breaks applications that rely on Thrift’s message-size enforcement to cap untrusted input before it is fully decompressed.

Notes

• In the Java and Go bindings, the vulnerable path is the stream-oriented read() behavior of TZlibTransport; applications that only write-through or otherwise avoid reading decompressed data are not exposed through this bug.
• The Python bindings expose an explicit decompressed-size limit parameter, and the default cap in Python tracks HARD_MAX_FRAME_SIZE; deployments that override those constructors may see a different effective ceiling.

• Apache Security Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• OSS Security Advisory
• Red Hat Bugzilla Bug