External risk intelligence

Apache Thrift THeaderTransport Heap-Based Buffer Overflow Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-91135

Apache Thrift is a framework for cross-language services. While often used for internal microservices, it can be exposed as a public-facing API depending on deployment. The vulnerability exists in the transport layer, making it reachable if the service is directly exposed to network traffic, though public exposure is not a default requirement.

Buffer Overflow

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability within Apache Thrift's C++ THeaderTransport component. Specifically, it involves a heap-based buffer overflow that can occur when data is compressed, potentially allowing for out-of-bounds writing. The primary concern is confirming the relevance and exposure of this component within your environment.

The issue impacts data handling during compression in Thrift.
Leadership should remember this due to potential for critical remote code execution.
Focus on verifying if Thrift is used and accessible externally.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to a Thrift application that uses the ZLIB transform. If the application improperly handles compressed data within its write buffer, the attacker's input could overflow the buffer, potentially leading to memory corruption or other unintended behavior.

Network exposure required.
Triggered by sending compressed data.
Can lead to memory corruption.

Live Threat

Current exploitation, exposure, and threat context

A heap-based buffer overflow in Apache Thrift's THeaderTransport could allow an attacker to cause a denial of service when ZLIB compression is enabled and an application processes crafted frames. This vulnerability could impact the availability of services relying on Thrift for inter-process communication when configured with the ZLIB transform.

Service availability.
Remote unauthenticated data manipulation.
Denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This heap-based buffer overflow vulnerability in Apache Thrift's THeaderTransport, particularly when ZLIB compression is enabled, necessitates a coordinated response from teams responsible for applications utilizing Thrift. The immediate priority is to identify all instances of affected Apache Thrift deployments, confirm their network exposure and criticality, and assign ownership for remediation.

Identify application and platform owners.
Verify network exposure and criticality.
Plan and execute Thrift upgrade.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Thrift and the THeaderTransport component?

Apache Thrift is a framework used to build scalable, cross-language services, allowing different parts of a system to communicate efficiently. The C++ THeaderTransport component handles the data transmission layer, specifically managing how frames are transported between these services. It acts as a bridge that enables various transport configurations, including data compression features designed to optimize network performance.

How does the heap-based buffer overflow work in CVE-2026-91135?

This vulnerability, classified as CWE-122 (Heap-based Buffer Overflow), occurs during data processing. When ZLIB compression is active, the software calculates space for compressed data but fails to account for content that expands rather than shrinks. Because the system writes this data into a fixed-size heap memory area without checking the capacity, it overflows the intended space, potentially overwriting adjacent memory.

What triggers the vulnerability during network communication?

The issue is triggered when an application utilizes the ZLIB transform to process incoming or outgoing data frames. It is important to note that the vulnerability does not trigger if ZLIB compression is disabled for those frames. The overflow specifically relies on the interaction between the THeaderTransport buffer logic and the unpredictability of data compression ratios on provided input.

Is my system at risk if it uses Apache Thrift?

According to Halo Surface Signal, risk depends on how your service is deployed. While Apache Thrift is frequently used for internal microservices, it can be exposed as a public-facing API. The vulnerability is reachable if the affected service is directly exposed to network traffic. You should determine if your specific Thrift-based services are accessible from untrusted networks or the internet.

How should I respond to CVE-2026-91135?

The recommended action is to identify all applications within your environment that rely on Apache Thrift C++ versions prior to 0.25.0. Once identified, evaluate their network accessibility to prioritize remediation. The primary resolution is to upgrade your Apache Thrift installation to version 0.25.0 or newer, which contains the necessary logic changes to prevent these memory management errors.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.