Skip to main content

Apache Thrift CVE-2026-41605

| EUVDEUVD-2026-26023 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-04-28
Denial Of Service Apache Node.js Integer Overflow Thrift
7.3
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
7.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
SUSE
HIGH
qualitative
Red Hat
7.7 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

8
Patch released
Apr 28, 2026 - 18:39 nvd
Patch available
Re-analysis Queued
Apr 28, 2026 - 16:37 vuln.today
cvss_changed
Analysis Generated
Apr 28, 2026 - 15:24 vuln.today
CVSS changed
Apr 28, 2026 - 15:22 NVD
7.3 (HIGH)
Patch available
Apr 28, 2026 - 11:01 EUVD
EUVD ID Assigned
Apr 28, 2026 - 00:45 euvd
EUVD-2026-26023
Analysis Generated
Apr 28, 2026 - 00:45 vuln.today
CVE Published
Apr 28, 2026 - 00:45 nvd
HIGH 7.3

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Integer overflow in Apache Thrift Swift Compact Protocol implementation versions prior to 0.23.0 enables remote unauthenticated attackers to achieve partial confidentiality, integrity, and availability impact. This is one of six related vulnerabilities disclosed simultaneously affecting multiple Apache Thrift language implementations (Swift, Node.js, C++, c_glib, Go). EPSS score of 0.02% (5th percentile) indicates low current exploitation probability, with no active exploitation confirmed by CISA KEV at time of analysis. Vendor-released patch version 0.23.0 addresses this and related Thrift implementation flaws.

Technical ContextAI

Apache Thrift is a cross-language RPC framework enabling communication between services written in different programming languages through serialization protocols including Compact Protocol. This vulnerability (CWE-190: Integer Overflow or Wraparound) affects the Swift language implementation's Compact Protocol handling. Integer overflows in serialization libraries are particularly dangerous because they occur during data parsing before application-level validation, allowing attackers to corrupt memory layouts, bypass length checks, or trigger unexpected behavior in downstream processing. The Compact Protocol is a binary encoding format designed for space efficiency, making integer boundary validation critical. Related CVEs affecting Node.js skip() recursion (CVE-2026-41636), C++ JSON out-of-bounds reads (CVE-2026-41607), c_glib dispatch stack overflow (CVE-2026-41606), Swift Range crash (CVE-2026-41604), and Go TFramedTransport uint32 overflow (CVE-2026-41602) indicate systemic input validation weaknesses across Thrift's multi-language codebase.

RemediationAI

Upgrade Apache Thrift to version 0.23.0 or later, which addresses CVE-2026-41605 and the five related vulnerabilities disclosed simultaneously (CVE-2026-41602 through CVE-2026-41607, excluding CVE-2026-41605). The vendor patch is available via standard Apache Thrift distribution channels and detailed in the official advisory at https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql and discussed on the oss-security mailing list at https://www.openwall.com/lists/oss-security/2026/04/28. For environments unable to upgrade immediately, implement network segmentation to restrict Thrift service exposure to trusted clients only, using firewall rules or service mesh policies to block untrusted network sources from reaching Swift-based Thrift endpoints (note: this reduces attack surface but does not eliminate risk from insider threats or compromised trusted systems). Deploy runtime application monitoring to detect anomalous Thrift message patterns including unusually large size fields or repeated connection attempts with malformed Compact Protocol data. Disable Swift Compact Protocol support if alternative protocols (Binary, JSON) are viable for your service architecture, though this requires client-side coordination and may break compatibility.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 12 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-41605 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy