CVE-2026-55971

GitHubCurated repository PoCExploitCexploitintel/eip-pocs-and-cves

PoC files

10 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script (poc/poc.py) that constructs and sends a malicious Thrift header-format frame to trigger a heap-based buffer overflow in Apache Thrift C++ THeaderTransport::untransform(). The script sends a zlib-compressed payload that decompresses to 1000 bytes, overwriting a 31-byte heap buffer, and then polls the target Docker container to confirm process death via signal, providing a verdict of successful exploitation.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward trigger for CVE-2026-55971. It sends a crafted Thrift frame to a vulnerable server and polls the Docker container's exit code to confirm a crash. No backdoor, deceptive payload, or concealed operator-directed harm is present. The code uses only standard libraries and performs no unrelated network activity, persistence, or credential theft.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareApache Thrift C++ bindings
Attack typesHeap-based Buffer OverflowDenial of Service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Python script that actively sends a malicious payload to trigger a heap-based buffer overflow in a vulnerable service and then verifies the crash, which constitutes exploitation code. The README and verification report confirm it is a PoC that exercises the vulnerability.

poc/poc.py:1-5poc/poc.py:20-33README.md:1poc_verification_report.md:1-6

Requirements

  • A running C++ Thrift endpoint using THeaderTransport (vulnerable versions 0.10.0 - 0.23.0) that accepts header-format connections.poc/poc.py:24-26
  • Network access to the target service.poc/poc.py:35-36
  • Docker CLI access to the lab container to verify process death (for the verdict mechanism).poc/poc.py:46-48

Observed behavior

  • Constructs a Thrift header-format frame with ZLIB_TRANSFORM declared and a zlib-compressed payload that decompresses to 1000 bytes.poc/poc.py:87-103
  • Sends the crafted frame to the target host and port via a TCP socket.poc/poc.py:106-120
  • Polls the Docker container state to check if the target process exited due to a signal (e.g., SIGABRT, SIGSEGV), confirming the heap overflow.poc/poc.py:123-140
  • Outputs [SUCCESS] if the target container died by signal, indicating successful exploitation.poc/poc.py:161-165
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Connects to user-supplied host:port to send exploit frameThis is the intended exploit trigger; no unrelated or covert connections are made.poc/poc.py:110-111
Process Execution
Runs 'docker inspect' to check container exit statusUsed to verify the exploit caused a crash; no other commands are executed.poc/poc.py:128-131
Review boundaries

What the analysis did not establish

  • Evidence is limited to the selected text files (README.md, poc/poc.py, poc_verification_report.md); 7 additional files in the artifact are unclassified and not analyzed.
  • The artifact's verdict mechanism relies on Docker CLI access to the lab container, which may not be available in all environments.
  • The exploit is designed for a specific lab setup (Docker Compose with ASAN builds) and may require adaptation for other targets.
  • Only the three text files included in the evidence packet were reviewed. Seven additional files (binary or unclassified) were present in the artifact but not analyzed; their content is unknown.
  • The review does not verify the correctness or safety of the exploit itself, only the absence of backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

CVE-2026-55971/docker-compose.yml

Created Vuln labCVE-2026-55971Compose · mixed

1 Compose manifest · 2 Dockerfiles · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose lab for CVE-2026-55971, an Apache Thrift C++ heap buffer overflow. It defines two services: a vulnerable target (thrift v0.23.0) and a patched control (thrift v0.24.0), both built from the same minimal server harness with AddressSanitizer.

CVE-2026-55971/docker-compose.yml:1-31CVE-2026-55971/README.md:1-140

Lab assessment

Vulnerability lab

The environment is explicitly designed to reproduce CVE-2026-55971. It includes a vulnerable service, a patched control service, a PoC script, and documentation describing the vulnerability, reproduction steps, and expected outcomes.

CVE-2026-55971/README.md:1-140CVE-2026-55971/docker-compose.yml:1-31
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles2
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

target

vulnerable serviceexploit target

A container built from Dockerfile.vulnerable, running a Thrift header transport server linked against libthrift v0.23.0 with AddressSanitizer. It listens on host port 9090 and is the intended target for the PoC exploit.

CVE-2026-55971/docker-compose.yml:5-17CVE-2026-55971/Dockerfile.vulnerable:1-57

control

patched servicecontrol group

A container built from Dockerfile.patched, running the same server harness but linked against libthrift v0.24.0 (fixed). It listens on host port 9091 and is used to verify that the PoC does not crash the patched version.

CVE-2026-55971/docker-compose.yml:19-31CVE-2026-55971/Dockerfile.patched:1-57

server.cpp

server harnessminimal Thrift endpoint

A minimal C++ Thrift server that accepts connections, negotiates THeaderTransport, and reads data in a loop. It is compiled into both the vulnerable and patched images to provide a consistent target for the overflow.

CVE-2026-55971/server.cpp:1-45

poc.py

proof-of-concept exploitverification script

A Python script that sends a crafted Thrift header frame with a zlib payload to trigger the heap overflow. It then polls the target container's exit state via the Docker CLI to confirm signal death, printing [SUCCESS] or [FAILED].

CVE-2026-55971/poc/poc.py:1-176

Dockerfile.vulnerable

vulnerable image build

Builds the vulnerable target image from ubuntu:24.04, clones Apache Thrift at tag v0.23.0, compiles it with AddressSanitizer, copies server.cpp, and links the server binary.

CVE-2026-55971/Dockerfile.vulnerable:1-57

Dockerfile.patched

patched image build

Builds the patched control image identically to Dockerfile.vulnerable, except it uses Thrift tag v0.24.0 (the fixed version).

CVE-2026-55971/Dockerfile.patched:1-57

docker-compose.yml

orchestrationlab definition

Defines the two services (target and control), their build contexts, port mappings, and health checks. It orchestrates the lab environment.

CVE-2026-55971/docker-compose.yml:1-31
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-55971

Supported by supplied evidence

The lab explicitly targets CVE-2026-55971. The README, PoC script, and verification report all describe the vulnerability as a heap buffer overflow in THeaderTransport::untransform() affecting Apache Thrift C++ 0.10.0–0.23.0, fixed in 0.24.0. The lab provides a vulnerable build (v0.23.0) and a patched build (v0.24.0) to demonstrate the issue.

CVE-2026-55971/README.md:1-140CVE-2026-55971/poc/poc.py:1-176CVE-2026-55971/poc_verification_report.md:1-38
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the lab containers.CVE-2026-55971/README.md:89-91
  • The PoC script requires Python 3 with standard library modules (socket, struct, subprocess, sys, time, zlib).CVE-2026-55971/poc/poc.py:1-176
  • The PoC script needs access to the Docker CLI to inspect the target container's exit state.CVE-2026-55971/poc/poc.py:120-130
  • The lab expects the vulnerable service to be reachable on host port 9090 and the control on port 9091.CVE-2026-55971/docker-compose.yml:10-11CVE-2026-55971/docker-compose.yml:24-25

Evidence-described exercise path

  1. Build and start both services using 'docker compose up -d --build'.CVE-2026-55971/README.md:93-95
  2. Run the PoC script against the vulnerable target on port 9090, providing the container name.CVE-2026-55971/README.md:97-100
  3. Observe the target container exit with a signal (e.g., exit code 133) and the PoC printing [SUCCESS].CVE-2026-55971/README.md:97-100CVE-2026-55971/poc_verification_report.md:10-14
  4. Bring the vulnerable service back up, then run the same PoC against the patched control on port 9091.CVE-2026-55971/README.md:103-105
  5. Verify the control server survives and the PoC prints [FAILED].CVE-2026-55971/README.md:103-105CVE-2026-55971/poc_verification_report.md:16-19
  6. Tear down the lab with 'docker compose down -v'.CVE-2026-55971/README.md:107-108
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the intended lab target (the vulnerable service). The PoC sends a crafted network frame to trigger a heap overflow in the target container, and verifies the crash by inspecting the container's exit state via the Docker CLI. There is no evidence of host escape, external connections, persistence, credential theft, data destruction, or backdoor behavior. The port mappings and Docker socket access are necessary for the lab's operation and are explicitly documented.

CVE-2026-55971/poc/poc.py:1-176CVE-2026-55971/README.md:89-108
Review boundaries

What the analysis did not establish

  • The packet does not include the actual Docker socket or host environment, so the PoC's Docker CLI interaction cannot be fully assessed for host impact beyond the documented container inspection.
  • The lab relies on the Docker CLI for verdict confirmation, which requires the Docker socket to be accessible from the host running the PoC; this is a documented prerequisite, not hidden behavior.
  • The packet does not contain the full build artifacts or runtime logs, only the source files and documentation.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1