Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache Thrift can expand compressed data to huge size
published 2 months ago
Summary
Versions of Apache Thrift older than 0.24.0 may accept specially crafted compressed messages that expand to a very large size when decompressed. This can consume a lot of memory or cause the application to stop working. Update Apache Thrift to version 0.24.0 to close the problem.
What to do
- Update echo thrift to version 0.19.0-4+e2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Echo | echo | thrift |
< 0.19.0-4+e2 Fix: upgrade to 0.19.0-4+e2
|
Original advisory text
ECHO-8af2-71e7-4b82
References
- https://advisory.echohq.com/cve/CVE-2026-48586 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-48586 URL
- https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9 URL
- https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq URL
- http://www.openwall.com/lists/oss-security/2026/07/24/37 URL
Timeline
Published18 Aug 2026
Updated18 Aug 2026
First seen18 Aug 2026
Sources
ECHO-8af2-71e7-4b82 · OSV
Track software like this
Free during beta