SB2026042851 - Multiple vulnerabilities in Apache Thrift

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026042851

SB2026042851 - Multiple vulnerabilities in Apache Thrift

Published: April 28, 2026 Updated: August 25, 2026

Security Bulletin ID SB2026042851
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Uncontrolled Recursion (CVE-ID: CVE-2026-41636)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the Node.js bindings skip() functionality when parsing input. A remote attacker can send specially crafted input to cause a denial of service.


2) Out-of-bounds read (CVE-ID: CVE-2026-41607)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the C++ JSON parser when parsing input. A remote attacker can send specially crafted input to disclose sensitive information.


3) Uncontrolled Recursion (CVE-ID: CVE-2026-41606)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in c_glib dispatch when processing crafted input. A remote attacker can send crafted input to cause a denial of service.


4) Integer overflow (CVE-ID: CVE-2026-41605)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow or wraparound in Swift Compact Protocol when parsing input. A remote attacker can send specially crafted input to cause a denial of service.


5) Out-of-bounds read (CVE-ID: CVE-2026-41604)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in skip() when parsing input. A remote attacker can supply crafted input to cause a denial of service.


6) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-41603)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to impersonate a trusted host.

The vulnerability exists due to improper validation of certificate with host mismatch in Java TSSLTransportFactory when establishing TLS connections. A remote attacker can present a certificate with a mismatched hostname to impersonate a trusted host.


7) Integer overflow (CVE-ID: CVE-2026-41602)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow or wraparound in the TFramedTransport Go language implementation when parsing framed transport data. A remote attacker can send specially crafted framed input to cause a denial of service.


8) Mismatched Memory Management Routines (CVE-ID: CVE-2025-48431)

CWE-ID: CWE-762 - Mismatched Memory Management Routines

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to mismatched memory management routines in c_glib language bindings when handling specially crafted requests. A remote attacker can send a specially crafted request to cause a denial of service.

The issue can terminate a c_glib-based Thrift server with a fatal "free(): invalid pointer" error.


9) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-43868)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory allocation with excessive size value in the Rust implementation when parsing input. A remote attacker can send specially crafted input to cause a denial of service.


10) Improper access control (CVE-ID: CVE-2026-43870)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass origin validation.

The vulnerability exists due to improper access control in Node.js web_server.js when handling cross-origin requests. A remote attacker can send a specially crafted request to bypass origin validation.


11) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-43869)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to spoof a trusted server.

The vulnerability exists due to improper validation of certificate with host mismatch in TSSLTransportFactory.java when establishing TLS connections. A remote attacker can present a certificate for a different host to spoof a trusted server.


Remediation

Install update from vendor's website.

References