What is the CVSS score of CVE-2026-41602?

CVE-2026-41602 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apache Thrift are affected by CVE-2026-41602?

Apache Thrift Go library versions prior to 0.23.0 contain an integer overflow vulnerability in TFramedTransport that allows remote attackers to crash server processes without authentication.. A patch is available.

How to fix or mitigate CVE-2026-41602?

Within 24 hours: Inventory all Go services using Apache Thrift and identify versions prior to 0.23.0. Within 7 days: Apply vendor patch by upgrading Apache Thrift to version 0.23.0 or later across all affected Go applications; verify patch deployment in non-production environments first. Within 30 days: Complete production rollout across all Thrift-dependent services and validate application stability post-patch; review related CVE disclosures affecting Java, Swift, and c_glib Thrift implementations in your infrastructure.

Apache Thrift CVE-2026-41602

EUVD-2026-26020 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-04-28

GHSA-wf45-q9ch-q8gh

Denial Of Service Integer Overflow Java Apache Thrift

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Apr 28, 2026 - 18:40 nvd

Patch available

Re-analysis Queued

Apr 28, 2026 - 16:37 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 15:23 vuln.today

CVSS changed

Apr 28, 2026 - 15:22 NVD

7.5 (HIGH)

Patch available

Apr 28, 2026 - 11:01 EUVD

EUVD ID Assigned

Apr 28, 2026 - 00:45 euvd

EUVD-2026-26020

Analysis Generated

Apr 28, 2026 - 00:45 vuln.today

CVE Published

Apr 28, 2026 - 00:45 nvd

HIGH 7.5

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Integer overflow in Apache Thrift's Go TFramedTransport implementation allows remote unauthenticated attackers to crash server processes via specially crafted uint32 values. Affects all Thrift versions prior to 0.23.0 with EPSS score of 0.02% (low exploitation probability). This is one of six related vulnerabilities disclosed simultaneously affecting different Thrift language bindings (Go, Swift, Java, c_glib), indicating coordinated security audit findings. Vendor patch available in version 0.23.0 released April 2026.

Technical ContextAI

Apache Thrift is a cross-language RPC framework supporting multiple programming languages through protocol/transport abstractions. TFramedTransport is a transport layer mechanism that prefixes messages with 4-byte length frames (uint32). The vulnerability stems from CWE-190 (Integer Overflow) in the Go language binding's frame size handling. When processing the uint32 frame length field, arithmetic operations can overflow, leading to incorrect memory allocation sizes or buffer operations. The CVSS vector AV:N/AC:L/PR:N indicates this is exploitable over network protocols without authentication, requiring only the ability to send crafted Thrift protocol messages to a listening service.

RemediationAI

Upgrade Apache Thrift to version 0.23.0 or later, which contains the fix for the uint32 overflow in Go TFramedTransport. The patch is available from Apache's official distribution channels and the vendor advisory at https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql. Organizations unable to upgrade immediately should restrict network access to Thrift endpoints using firewall rules or network segmentation, limiting exposure to trusted internal networks only - this reduces attack surface but does not eliminate risk from insider threats or compromised internal systems. Consider implementing input validation middleware to reject malformed frame headers, though this adds complexity and may not catch all overflow conditions. For Go-based Thrift services exposed to the internet, prioritize patching over workarounds due to the unauthenticated network attack vector. Review other language bindings in use as the coordinated disclosure (CVE-2026-41603 through 41606) indicates multiple Thrift components require updates.

More in Java

View all

CVE-2012-4681 CRITICAL Emergency POC

9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m

CVE-2015-7450 CRITICAL Emergency POC

9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti

CVE-2013-2465 CRITICAL Act Now POC

9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2010-1871 HIGH Act Now POC

8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to

CVE-2012-1723 CRITICAL Emergency POC

9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2015-4852 CRITICAL Act Now POC

9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL Act Now POC

9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

CVE-2017-3066 CRITICAL Act Now POC

9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla

CVE-2012-0391 CRITICAL Act Now POC

9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-190 – Integer Overflow or Wraparound

View all

CVE-2013-2729 CRITICAL POC

9.8

CVE-2015-8651 HIGH

8.8

CVE-2012-5054 HIGH POC

8.8

CVE-2014-0569 CRITICAL POC

9.3

CVE-2017-3599 HIGH POC

7.5

CVE-2017-7529 HIGH

7.5

CVE-2016-1010 HIGH

8.8

CVE-2013-3940 CRITICAL

9.3

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 12	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

CVE-2026-41602 vulnerability details – vuln.today

Back

Apache Thrift CVE-2026-41602

Severity by source

CVSS VectorVendor

Lifecycle Timeline

Description PRE-NVD

AnalysisAI

Technical ContextAI

RemediationAI

More in Java

Same weakness CWE-190 – Integer Overflow or Wraparound

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code