CVE-2026-93926: Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path
Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Thriftto a version that resolves this vulnerability.Fixed in 0.25.0
Event History
Frequently Asked Questions
Which deployments need to be reviewed?
Deployments using Apache Thrift versions before 0.25.0 should be reviewed, particularly where the C++ THeaderTransport implementation is in use. The provided information does not identify affected configurations beyond that component.
What is the recommended remediation?
Upgrade Apache Thrift to version 0.25.0. This version fixes the zlib stream resource-release issue in THeaderTransport::untransform().
Is a workaround available if an upgrade cannot be performed immediately?
No workaround or compensating configuration is provided in the available information. The documented remediation is upgrading to 0.25.0.