What is the CVSS score of CVE-2026-43869?

CVE-2026-43869 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Apache Thrift are affected by CVE-2026-43869?

Apache Thrift Java versions before 0.23.0 disable TLS hostname verification, allowing attackers to intercept and modify encrypted communications between applications and Thrift services without…. A patch is available.

How to fix or mitigate CVE-2026-43869?

Within 24 hours: Identify all applications and services using Apache Thrift Java in your environment and document current versions. Within 7 days: Upgrade Apache Thrift Java to version 0.23.0 or later across development, staging, and production systems; validate SSL/TLS hostname verification is enabled post-upgrade. Within 30 days: Conduct network segmentation audit to ensure Thrift services operate only on trusted internal networks and review application logs for suspicious TLS connection attempts during the interim period.

Apache Thrift CVE-2026-43869

EUVD-2026-27237 HIGH

Improper Validation of Certificate with Host Mismatch (CWE-297)

2026-05-05

GHSA-7pwc-h2j2-rjgj

Information Disclosure Apache Java Node.js Thrift

7.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 16:30 vuln.today

CVSS changed

May 06, 2026 - 14:22 NVD

7.3 (HIGH)

Patch available

May 05, 2026 - 09:01 EUVD

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

420 maven packages depend on org.apache.thrift:libthrift (113 direct, 316 indirect)

Ecosystem-wide dependent count for version 0.23.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

TLS hostname verification is disabled in Apache Thrift's Java TSSLTransportFactory implementation (versions prior to 0.23.0), allowing remote unauthenticated attackers to perform man-in-the-middle attacks against encrypted communications. The vulnerability enables interception and potential modification of data in transit with low attack complexity and no user interaction required. While EPSS shows minimal current exploitation activity (0.00%), CISA SSVC classifies this as automatable with partial technical impact, and a vendor patch is available in version 0.23.0.

Technical ContextAI

Apache Thrift is a cross-language RPC framework supporting multiple protocols and transports. This vulnerability affects the TSSLTransportFactory.java component in the Java implementation, which handles TLS/SSL transport layer setup. The flaw is classified as CWE-297 (Improper Certificate Validation), specifically involving hostname verification failure during TLS handshakes. When hostname verification is disabled or improperly implemented, the client accepts certificates for any hostname rather than validating that the certificate matches the server's actual identity. This breaks the authentication component of TLS, reducing encrypted connections to encryption-only without server identity assurance. The Java implementation's SSL transport factory is commonly used in microservices architectures and backend service-to-service communication where Thrift provides the RPC layer.

RemediationAI

Upgrade Apache Thrift to version 0.23.0 or later, which implements proper hostname verification in TSSLTransportFactory.java per the vendor advisory published 2026-05-05. For Java applications, update the org.apache.thrift dependency to 0.23.0 in Maven/Gradle build files and redeploy affected services. If immediate upgrade is not feasible, implement compensating controls: restrict Thrift service communication to isolated VLANs or private networks with strict network access controls, deploy mutual TLS (mTLS) with client certificate validation as an additional authentication layer, or implement application-layer message signing to detect tampering independent of transport security. Network-level mitigations include deploying intrusion detection systems monitoring for TLS certificate anomalies and enforcing certificate pinning at the application layer where possible. Note that network isolation significantly reduces but does not eliminate risk, as internal network compromise remains a viable attack path. Monitor Apache security advisories at lists.apache.org for updates, as the disclosure references multiple related Thrift vulnerabilities (CVE-2026-43868, CVE-2026-43870) requiring concurrent attention.