What is the CVSS score of CVE-2026-41604?

CVE-2026-41604 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apache Thrift are affected by CVE-2026-41604?

Apache Thrift Swift versions before 0.23.0 contain an out-of-bounds read vulnerability that allows unauthenticated remote attackers to cause service disruptions and leak memory contents through…. A patch is available.

How to fix or mitigate CVE-2026-41604?

Within 24 hours: Identify all systems running Apache Thrift Swift and document current versions in use. Within 7 days: Upgrade all Thrift Swift implementations to version 0.23.0 or later; prioritize internet-facing services and those processing untrusted network data. Within 30 days: Verify patch deployment across the entire environment, validate application functionality post-upgrade, and document the completion of remediation efforts.

Apache Thrift CVE-2026-41604

EUVD-2026-26022 HIGH

Out-of-bounds Read (CWE-125)

2026-04-28

Buffer Overflow Information Disclosure Java Apache Thrift

8.2

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Apr 28, 2026 - 18:40 nvd

Patch available

Re-analysis Queued

Apr 28, 2026 - 16:37 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 15:24 vuln.today

CVSS changed

Apr 28, 2026 - 15:22 NVD

8.2 (HIGH)

Patch available

Apr 28, 2026 - 11:01 EUVD

EUVD ID Assigned

Apr 28, 2026 - 00:45 euvd

EUVD-2026-26022

Analysis Generated

Apr 28, 2026 - 00:45 vuln.today

CVE Published

Apr 28, 2026 - 00:45 nvd

HIGH 8.2

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Out-of-bounds read vulnerability in Apache Thrift Swift implementation allows remote unauthenticated attackers to trigger denial of service and disclose limited memory contents via malformed skip() operations during protocol deserialization. Affects all versions prior to 0.23.0, with publicly disclosed exploit details on oss-security mailing list. EPSS exploitation probability remains low (5th percentile) despite network-accessible attack vector, suggesting limited real-world targeting to date. Vendor patch released in version 0.23.0 addresses all six concurrently disclosed Thrift vulnerabilities (CVE-2026-41602 through CVE-2026-41607).

Technical ContextAI

Apache Thrift is a cross-language RPC framework supporting multiple protocol implementations including Swift, C++, Java, Go, and c_glib bindings. This vulnerability represents a CWE-125 out-of-bounds read occurring in the Swift language binding's Compact Protocol implementation, specifically within the skip() function used during field deserialization. The skip() function traverses type descriptors without properly validating range boundaries, allowing crafted Thrift messages to reference memory outside allocated buffers. The disclosure clusters six distinct CVEs affecting different language bindings (Swift range handling, C++ JSON parsing, Go uint32 handling, Java TLS verification, c_glib stack overflow), indicating systemic input validation weaknesses across the Thrift ecosystem rather than isolated implementation flaws. The CWE-125 classification confirms read-only access violations, distinguishing this from write-based buffer overflows that enable code execution.

RemediationAI

Upgrade to Apache Thrift version 0.23.0 or later, which addresses all six disclosed vulnerabilities per the vendor advisory published April 28, 2026 on oss-security and archived at https://www.openwall.com/lists/oss-security/2026/04/28 and https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql. For Swift-specific CVE-2026-41604 remediation, version 0.23.0 includes range validation fixes in skip() deserialization logic. If immediate patching is infeasible, deploy network-layer compensating controls: restrict Thrift service endpoints to authenticated internal networks only (eliminates PR:N attack vector), implement strict input size limits at load balancers to prevent oversized crafted messages (mitigates memory exhaustion from repeated exploitation), and enable verbose logging to detect anomalous skip() call patterns during deserialization (provides forensic visibility). These mitigations reduce remote attack surface but do not eliminate the underlying vulnerability-consider these temporary measures only, as they introduce operational overhead in monitoring and may impact legitimate large message handling. Multi-CVE nature of disclosure suggests urgency in patching entire Thrift stack rather than language-specific workarounds.

More in Java

View all

CVE-2012-4681 CRITICAL Emergency POC

9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m

CVE-2015-7450 CRITICAL Emergency POC

9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti

CVE-2013-2465 CRITICAL Act Now POC

9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2010-1871 HIGH Act Now POC

8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to

CVE-2012-1723 CRITICAL Emergency POC

9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2015-4852 CRITICAL Act Now POC

9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL Act Now POC

9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

CVE-2017-3066 CRITICAL Act Now POC

9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla

CVE-2012-0391 CRITICAL Act Now POC

9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

7.5

CVE-2016-5198 HIGH POC

8.8

CVE-2016-1646 HIGH POC

8.8

CVE-2025-5777 HIGH POC

7.5

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2017-11882 HIGH POC

7.8

CVE-2010-3333 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 12	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

CVE-2026-41604 vulnerability details – vuln.today

Back

Apache Thrift CVE-2026-41604

Severity by source

CVSS VectorVendor

Lifecycle Timeline

Description PRE-NVD

AnalysisAI

Technical ContextAI

RemediationAI

More in Java

Same weakness CWE-125 – Out-of-bounds Read

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code