AIKIDO-2026-943471
thrift is vulnerable to Denial of Service (DoS)
82
High Risk
This Affects:
thriftTL;DR
TZlibTransport.readComp applies max_decompressed_size only after it has already read and decompressed, and it treats a zero remaining budget as still allowed. Once the cap is exactly used up, further highly compressible input can expand past it. The fix checks that the remaining budget is already exhausted before any further read or decompress.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use TZlibTransport with max_decompressed_size against untrusted peers.
Background info
thrift is vulnerable to Denial of Service (DoS) in versions 0.24.0 - 0.24.0.
How to fix this
Upgrade the thrift library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.