[
https://issues.apache.org/jira/browse/THRIFT-6089?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jens Geyer resolved THRIFT-6089.
--------------------------------
Assignee: Jens Geyer
Resolution: Fixed
> Bound decompressed size for Ruby HeaderTransport ZLIB transform
> ---------------------------------------------------------------
>
> Key: THRIFT-6089
> URL: https://issues.apache.org/jira/browse/THRIFT-6089
> Project: Thrift
> Issue Type: Bug
> Components: Ruby - Library
> Reporter: Jens Geyer
> Assignee: Jens Geyer
> Priority: Major
> Fix For: 0.24.0
>
>
> parse_header_format in header_transport.rb applied
> Zlib::Inflate.inflate(payload) to the ZLIB transform with no limit on the
> decompressed output size. The existing frame-size check bounded only the
> compressed wire frame. The reporter's proof-of-concept demonstrated a 1020:1
> amplification ratio (a ~2KB compressed frame producing a ~2MB allocation)
> with no authentication gate before the code path.
> Fixed by replacing the one-shot inflate with a streaming loop that
> accumulates decompressed bytes and raises TransportException once a
> configurable @max_decompressed_size (default MAX_FRAME_SIZE) is exceeded,
> mirroring the Python fix (CVE-2026-41608).
> *Affects:* Ruby HeaderTransport with ZLIB transform support, confirmed
> present in 0.23.0; fixed in 0.24.0
> *Fixed by:* branch {{ruby-header-zlib-limit}}, PR #3547
> *CWE-409:* Improper Handling of Highly Compressed Data (Data Amplification)
> *CVSS 4.0:* 8.7 High
> ({{CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N}})
> *Reported by:* LTSHFWJT, via [email protected]
> *CVE:* CVE-2026-49158
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
