CVE-2026-66054: Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize

Q: Which deployments are affected?

Apache Thrift deployments using the C++ bindings are affected if they use a version before 0.25.0. The issue is specifically in THeaderTransport.

Q: What is the recommended remediation?

Upgrade Apache Thrift to version 0.25.0, which fixes the issue.

Published Oct 2, 2026

Updated

Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++ bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Affected Software

1 affected component

Apache Thrift<0.25.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Thrift C++ bindings to a version that resolves this vulnerability.
Fixed in 0.25.0

Event History

Oct 2, 2026

CVE Published

via MITRE·12:58 PM

Data Sourced

via MITRE·12:58 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Apache Thrift deployments using the C++ bindings are affected if they use a version before 0.25.0. The issue is specifically in THeaderTransport.

What is the recommended remediation?

Upgrade Apache Thrift to version 0.25.0, which fixes the issue.

CVE-2026-66054: Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What is the recommended remediation?