CVE-2026-94636: Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up
Published Oct 2, 2026
·Updated
Apache Thrift: Python TZlibTransport stops enforcing its decompressed-size limit once the limit is exactly used up
Other sources
Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
— NVD
Affected Software
3 affected componentsFixes available
Apache Thrift<0.25.0
Microsoft azl3 thrift 0.24.0-1<0.25.0-1
0.25.0-1
IBM Process Mining<=2.0.0 - 2.2.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.25.0-1 - Upgrade
Upgrade
Apache Thrift Python bindingsto a version that resolves this vulnerability.Fixed in 0.25.0
Event History
Oct 2, 2026
CVE Published
via MITRE·11:47 AM
Data Sourced
via MITRE·11:47 AM
DescriptionWeakness
Data Sourced
via NVD·12:17 PM
DescriptionSeverityWeakness
Oct 3, 2026
Data Sourced
via Microsoft·08:05 AM
DescriptionSeverityWeaknessAffected Software
Oct 30, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software