TLS hostname verification bypass in Apache Thrift c_glib bindings (CVE-2026-48144)

The c_glib TLS client bindings in Apache Thrift fail to properly validate that a server's certificate matches the expected hostname. This allows a network attacker to intercept TLS connections by presenting a certificate for a different host without being detected. Affected versions: - Apache Thrift (glibc language bindings) before 0.24.0 We recommend updating to: 0.24.0. CVSS 9.1 · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/263 Details: https://vuln.today/cve/CVE-2026-48144