What is the CVSS score of CVE-2026-41605?

CVE-2026-41605 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Apache Thrift are affected by CVE-2026-41605?

Apache Thrift Swift Compact Protocol versions before 0.23.0 contain an integer overflow vulnerability allowing unauthenticated remote attackers to compromise confidentiality, integrity, and…. A patch is available.

How to fix or mitigate CVE-2026-41605?

Within 24 hours: Inventory all Swift applications and services using Apache Thrift and confirm current versions. Within 7 days: Apply vendor-released patch upgrading Apache Thrift Swift to version 0.23.0 or later across development, staging, and production environments. Within 30 days: Complete patch validation testing and confirm all instances have been upgraded; document and communicate deployment completion to security and compliance teams.

Apache Thrift CVE-2026-41605

EUVD-2026-26023 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-04-28

Node.js Integer Overflow Denial Of Service Apache Thrift

7.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SUSE

HIGH

qualitative

Red Hat

7.7 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Apr 28, 2026 - 18:39 nvd

Patch available

Re-analysis Queued

Apr 28, 2026 - 16:37 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 15:24 vuln.today

CVSS changed

Apr 28, 2026 - 15:22 NVD

7.3 (HIGH)

Patch available

Apr 28, 2026 - 11:01 EUVD

EUVD ID Assigned

Apr 28, 2026 - 00:45 euvd

EUVD-2026-26023

Analysis Generated

Apr 28, 2026 - 00:45 vuln.today

CVE Published

Apr 28, 2026 - 00:45 nvd

HIGH 7.3

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Integer overflow in Apache Thrift Swift Compact Protocol implementation versions prior to 0.23.0 enables remote unauthenticated attackers to achieve partial confidentiality, integrity, and availability impact. This is one of six related vulnerabilities disclosed simultaneously affecting multiple Apache Thrift language implementations (Swift, Node.js, C++, c_glib, Go). EPSS score of 0.02% (5th percentile) indicates low current exploitation probability, with no active exploitation confirmed by CISA KEV at time of analysis. Vendor-released patch version 0.23.0 addresses this and related Thrift implementation flaws.

Technical ContextAI

Apache Thrift is a cross-language RPC framework enabling communication between services written in different programming languages through serialization protocols including Compact Protocol. This vulnerability (CWE-190: Integer Overflow or Wraparound) affects the Swift language implementation's Compact Protocol handling. Integer overflows in serialization libraries are particularly dangerous because they occur during data parsing before application-level validation, allowing attackers to corrupt memory layouts, bypass length checks, or trigger unexpected behavior in downstream processing. The Compact Protocol is a binary encoding format designed for space efficiency, making integer boundary validation critical. Related CVEs affecting Node.js skip() recursion (CVE-2026-41636), C++ JSON out-of-bounds reads (CVE-2026-41607), c_glib dispatch stack overflow (CVE-2026-41606), Swift Range crash (CVE-2026-41604), and Go TFramedTransport uint32 overflow (CVE-2026-41602) indicate systemic input validation weaknesses across Thrift's multi-language codebase.

RemediationAI

Upgrade Apache Thrift to version 0.23.0 or later, which addresses CVE-2026-41605 and the five related vulnerabilities disclosed simultaneously (CVE-2026-41602 through CVE-2026-41607, excluding CVE-2026-41605). The vendor patch is available via standard Apache Thrift distribution channels and detailed in the official advisory at https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql and discussed on the oss-security mailing list at https://www.openwall.com/lists/oss-security/2026/04/28. For environments unable to upgrade immediately, implement network segmentation to restrict Thrift service exposure to trusted clients only, using firewall rules or service mesh policies to block untrusted network sources from reaching Swift-based Thrift endpoints (note: this reduces attack surface but does not eliminate risk from insider threats or compromised trusted systems). Deploy runtime application monitoring to detect anomalous Thrift message patterns including unusually large size fields or repeated connection attempts with malformed Compact Protocol data. Disable Swift Compact Protocol support if alternative protocols (Binary, JSON) are viable for your service architecture, though this requires client-side coordination and may break compatibility.

More in Node.js

View all

CVE-2024-55591 CRITICAL Emergency POC

9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote

CVE-2014-7205 CRITICAL Act Now POC

10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

CVE-2025-59528 CRITICAL Act Now POC

10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

CVE-2017-14849 HIGH Act Now POC

7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc

CVE-2017-5941 CRITICAL Emergency POC

9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner

CVE-2014-3744 HIGH Act Now POC

7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

CVE-2014-9566 HIGH Act Now POC

7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

CVE-2013-4660 MEDIUM This Month POC

6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

CVE-2015-5688 MEDIUM This Month POC

5.0 Sep 04

Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read

CVE-2026-45321 CRITICAL Act Now POC

9.6 May 12

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio

CVE-2014-7192 CRITICAL Act Now POC

10.0 Dec 11

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat

CVE-2013-4450 MEDIUM This Month POC

5.0 Oct 21

The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se

Same weakness CWE-190 – Integer Overflow or Wraparound

View all

CVE-2013-2729 CRITICAL POC

9.8

CVE-2015-8651 HIGH

8.8

CVE-2012-5054 HIGH POC

8.8

CVE-2014-0569 CRITICAL POC

9.3

CVE-2017-3599 HIGH POC

7.5

CVE-2017-7529 HIGH

7.5

CVE-2016-1010 HIGH

8.8

CVE-2013-3940 CRITICAL

9.3

Same technique Integer Overflow

View all

CVE-2014-0497 CRITICAL POC

9.8

CVE-2013-2729 CRITICAL POC

9.8

CVE-2015-8651 HIGH

8.8

CVE-2012-5054 HIGH POC

8.8

CVE-2014-0569 CRITICAL POC

9.3

CVE-2017-3599 HIGH POC

7.5

CVE-2017-7529 HIGH

7.5

CVE-2016-1010 HIGH

8.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 12	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

CVE-2026-41605 vulnerability details – vuln.today

Back

Apache Thrift CVE-2026-41605

Severity by source

CVSS VectorVendor

Lifecycle Timeline

Description PRE-NVD

AnalysisAI

Technical ContextAI

RemediationAI

More in Node.js

Same weakness CWE-190 – Integer Overflow or Wraparound

Same technique Integer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code