What is the CVSS score of CVE-2026-55970?

CVE-2026-55970 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.8%.

How to fix or mitigate CVE-2026-55970?

Within 24 hours, review all deployments of Apache Thrift (versions before 0.24.0) and identify C++ services using THeaderTransport. Ensure no untrusted networks directly reach these endpoints; restrict access to trusted internal IPs only. Within 7 days, implement anomaly detection rules to monitor for unusual memory access patterns or crashes in Thrift services. Investigate hardening options such as enabling ASLR and using sandboxing (e.g., containers with reduced capabilities). Within 30 days, coordinate with vendors or open-source maintainers for patch timelines; if no patch emerges, plan to migrate affected Thrift components to alternative communication protocols or apply runtime memory protections (e.g., address sanitizers in testing environments).

Apache Thrift CVE-2026-55970

Q: Which versions of Apache Thrift are affected by CVE-2026-55970?

Apache Thrift, a critical inter-service communication framework in many enterprise systems, contains a heap out-of-bounds read vulnerability (CVE-2026-55970) in its C++ implementation.. A patch is available.

EUVD-2026-49154 MEDIUM

Buffer Over-read (CWE-126)

2026-07-24

GHSA-g7xp-pggm-c7w2

Buffer Overflow Apache Thrift

6.9

CVSS 4.0 · Vendor

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send crafted Thrift message with malformed header
Exploit

THeaderTransport::readHeaderFormat() performs out-of-bounds heap read
Impact

Confidential data leak or service crash.

Vulnerability Assessment

Weakness	CWE CWE-126 ASVS 5.0 V15 - Secure Coding and Architecture Buffer over-read prevention
Exploitation Conditions	The vulnerability is triggered when the Thrift service uses the C++ binding with the THeaderTransport protocol. No authentication or user interaction is indicated in the description; however, the exact attack vector (network or local) is not confirmed by the vendor. The absence of a CVSS vector leaves precise access requirements unknown.
Impact	No CVSS vector is provided by NVD or the vendor, leaving key exploitability metrics unknown. EPSS score and POC availability are also unavailable; there is no evidence of active exploitation. Without these signals, a definitive risk rating cannot be assigned, but the nature of the flaw in a widely-used RPC framework suggests a moderate to high information‐disclosure risk. Organizations should prioritize patching consistent with standard vulnerability management practices.
Exploit ScenarioDerived	A remote attacker could send a specially crafted Thrift message containing a malformed header to a vulnerable service. The THeaderTransport parser would then read beyond the allocated heap buffer, potentially leaking sensitive data or causing the service to crash. No proof-of-concept is publicly available.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 26, 2026

Heap out-of-bounds read in Apache Thrift's C++ THeaderTransport::readHeaderFormat() allows remote attackers to read unintended memory contents, potentially leading to information disclosure or denial of service. All versions before 0.24.0 are affected. No public exploit code has been reported.

RemediationAI

Upgrade to Apache Thrift 0.24.0 or later. The official fix is included in that release; no workarounds are published. If immediate patching is not possible, consider network segmentation or strict access controls to limit exposure of Thrift services.

Affected VersionsENISA

Apache Thrift 0 <0.24.0

Affected Packages

euvd apache_thrift fix: 0.24.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability lies in the C++ bindings of Apache Thrift, an RPC and serialization framework. Specifically, the THeaderTransport::readHeaderFormat() function, which handles binary header parsing, performs an out-of-bounds read on the heap. This class of bug (CWE-126) can expose sensitive memory contents or crash the process. The affected component is part of the core transport layer used in Thrift services across many distributed systems.

Know when Thrift gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

vuln.today AI 6.5 MEDIUM

Remote unauthenticated attacker can trigger over-read with crafted packet, potentially leaking memory and crashing the service.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE MEDIUM

Red Hat 6.5 MEDIUM

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

None

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Jul 27, 2026 - 12:16 EUVD

CVE Published

Jul 24, 2026 - 22:45 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

Apache Thrift, a critical inter-service communication framework in many enterprise systems, contains a heap out-of-bounds read vulnerability (CVE-2026-55970) in its C++ implementation. This flaw could allow remote attackers to access sensitive memory contents or cause service disruption. Leadership should prioritize mitigation as Thrift is often deployed in high‑availability microservices environments where confidentiality and uptime are paramount.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to Thrift endpoints to trusted hosts, enable memory protection (ASLR, NX), deploy intrusion detection systems to flag anomalous Thrift traffic, and consider using a different inter-service communication framework for new deployments until a patch is available.

Threat Intelligence Overview

EPSS Score

0.8%

Top 46% exploitable

Prevalence

High

widely-used RPC framework in enterprise distributed systems

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.8%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +34

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.