EUVD-2026-49149
GHSA-p2c7-c4gw-678h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessMan-in-the-middle position
-
DeliveryServe crafted TLS certificate with malicious wildcard
-
ExploitThrift client accepts certificate due to matchName() bypass
-
ExecutionEstablish encrypted session under attacker control
-
ImpactRead and modify Thrift RPC messages
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate host validation
|
| Exploitation Conditions | The Thrift C++ application must be using TSSLSocket with TLS and have hostname verification enabled (default setting). Additionally, the attacker must be in a position to intercept network traffic between the client and server (man-in-the-middle). The attacker requires a valid X.509 certificate for a domain whose wildcard pattern is mishandled by the flawed matchName() logic; for example, a wildcard that RFC 6125 would normally reject. The vulnerability is not remotely exploitable at scale without network positioning - there is no pre-authentication remote code execution vector. |
| Impact | No CVSS vector, EPSS score, KEV listing, or public proof-of-concept were available at the time of analysis. The vulnerability inherently requires an attacker to be in a man-in-the-middle position between the client and server, which increases attack complexity significantly. Once intercepted, the attacker could read and modify Thrift messages, leading to high confidentiality and integrity impact. Without active exploitation data, the practical risk appears moderate: high severity if successfully exploited, but exploitability is constrained by the network positioning requirement. The absence of KEV and EPSS suggests the flaw is not currently being targeted in the wild. Decision-makers should weigh the sensitivity of Thrift-based communication and network trust model; for internal, trusted networks the risk is lower. |
| Exploit ScenarioDerived | An attacker on the same network segment intercepts TLS traffic between a Thrift client and server by ARP spoofing or similar technique. The attacker presents a certificate for a domain like '*.example.com', which the vulnerable matchName() incorrectly accepts for the server 'api.example.com'. The attacker then transparently proxies the RPC session, reading and modifying sensitive data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 26, 2026
TLS hostname verification bypass in Apache Thrift C++ bindings allows man-in-the-middle interception of Thrift RPC communications. The vulnerability resides in the TSSLSocket matchName() function's handling of wildcard certificates per RFC 6125, permitting an attacker with a crafted certificate to impersonate a legitimate server. Upgrading to version 0.24.0 fixes the flaw; no active exploitation or public exploit has been identified at this time.
RemediationAI
Upgrade to Apache Thrift 0.24.0, which contains the corrected matchName() implementation. No workarounds are specified; as a temporary measure, restrict network access to Thrift services to trusted segments and disable the use of wildcard certificates on servers until the upgrade is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Thrift is a framework for scalable cross-language services development, using an interface definition language to define RPC services. The C++ bindings include TSSLSocket, which wraps TLS socket communication and performs hostname verification via a matchName() function. This function is responsible for comparing the server's X.509 certificate's Subject Alternative Name (SAN) or Common Name against the expected hostname, adhering to RFC 6125 rules including wildcard handling. A logic flaw in the implementation causes improper validation of certain wildcard patterns, effectively bypassing certificate hostname checks. The root cause class aligns with CWE-295 (Improper Certificate Validation).
Know when Thrift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
MITM requirement justifies AC:H; full confidentiality and integrity impact on intercepted communication, no availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code e
Heap-based buffer overflow in Apache Thrift C++ THeaderTransport::untransform() allows remote code execution by sending
Improper certificate validation in Apache Thrift c_glib TLS clients allows man-in-the-middle attackers to intercept or t
Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an ou
Denial of service vulnerability in Apache Thrift Rust bindings prior to 0.24.0 allows remote attackers to exhaust memory
Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affe
Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU r
Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources b
Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger in
Out-of-bounds read vulnerability in Apache Thrift Swift implementation allows remote unauthenticated attackers to trigge
Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers o
Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. Rated
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB