SB2026082559 - Multiple vulnerabilities in Apache Thrift

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082559

SB2026082559 - Multiple vulnerabilities in Apache Thrift

Published: August 25, 2026

Security Bulletin ID SB2026082559
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 15
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 15 vulnerabilities.


1) Improper handling of highly compressed data (CVE-ID: CVE-2026-41608)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of highly compressed data in Python THeaderTransport when processing compressed input. A remote attacker can send specially crafted compressed data to cause a denial of service.


2) Infinite loop (CVE-ID: CVE-2026-43871)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in TCompactProtocol varint handling when parsing input. A remote attacker can send specially crafted serialized data to cause a denial of service.


3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-45112)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in Apache Thrift Java bindings when processing input. A remote attacker can send specially crafted input to cause a denial of service.


4) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-48144)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to impersonate a trusted server.

The vulnerability exists due to improper validation of certificate with host mismatch in the c_glib TLS client when establishing TLS connections. A remote attacker can present a certificate for a different host to impersonate a trusted server.


5) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-48145)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass hostname verification.

The vulnerability exists due to improper validation of certificate with host mismatch in the C++ TSSLSocket matchName() function when validating wildcard certificate names during TLS certificate verification. A remote attacker can present a crafted certificate with a mismatched hostname to bypass hostname verification.


6) Improper handling of highly compressed data (CVE-ID: CVE-2026-48586)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of highly compressed data in TZlibTransport when processing compressed input. A remote attacker can send specially crafted compressed data to cause a denial of service.


7) Improper handling of highly compressed data (CVE-ID: CVE-2026-49158)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of highly compressed data in Ruby THeaderTransport ZLIB decompression when processing compressed transport data. A remote attacker can send highly compressed data to cause a denial of service.


8) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-55968)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity and allocation of resources without limits or throttling in Node.js server receive transports when processing input. A remote attacker can send specially crafted input to cause a denial of service.


9) Integer overflow (CVE-ID: CVE-2026-55969)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in TProtocol::checkReadBytesAvailable() in the C++ and c_glib bindings when parsing input. A remote attacker can send specially crafted input to cause a denial of service.


10) Out-of-bounds read (CVE-ID: CVE-2026-55970)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in THeaderTransport::readHeaderFormat() when parsing input. A remote attacker can send specially crafted input to disclose sensitive information.


11) Heap-based buffer overflow (CVE-ID: CVE-2026-55971)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in THeaderTransport::untransform() when processing ZLIB-compressed data. A remote attacker can send specially crafted compressed input to cause a denial of service or execute arbitrary code.


12) Out-of-bounds read (CVE-ID: CVE-2026-58023)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the c_glib transport leftover-bytes path when parsing input. A remote attacker can send specially crafted input to disclose sensitive information.


13) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-58389)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the Rust binary protocol non-strict path when parsing crafted string fields. A remote attacker can send specially crafted input to cause a denial of service.


14) Out-of-bounds read (CVE-ID: CVE-2026-58662)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the C++ THeaderTransport::readString() function when parsing input. A remote attacker can send specially crafted input to disclose sensitive information.


15) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-66053)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass hostname verification in TLS certificate validation.

The vulnerability exists due to improper validation of certificate with host mismatch in the Python TSSLSocket hostname matcher import in Apache Thrift Python bindings when establishing TLS connections. A remote attacker can present a certificate with a mismatched hostname to bypass hostname verification in TLS certificate validation.


Remediation

Install update from vendor's website.

References