High [CVE-2026-48586] Denial of Service via improper handling of highly compressed data

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue. This vulnerability, categorized as improper handling of highly compressed data (also known as data amplification), allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted, highly compressed data.

The affected component fails to properly manage the expansion of this data, leading to resource exhaustion and system unavailability. This Important vulnerability in Apache Thrift's handling of highly compressed data can lead to a denial of service.

Remote, unauthenticated attackers could exploit this flaw by sending specially crafted compressed data, causing excessive resource consumption and disrupting the availability of services utilizing vulnerable Thrift bindings in Red Hat products. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Weakness: CWE-409.

Affected products named by the advisory: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33; Red Hat Advanced Cluster Management for Kubernetes 2.17; Red Hat AI Inference Server 3.2; Red Hat Hardened Images; and 15 more.