Which versions of Apache Thrift are affected by CVE-2026-55970?

Apache Thrift, a critical inter-service communication framework in many enterprise systems, contains a heap out-of-bounds read vulnerability (CVE-2026-55970) in its C++ implementation.. A patch is available.

How to fix or mitigate CVE-2026-55970?

Within 24 hours, review all deployments of Apache Thrift (versions before 0.24.0) and identify C++ services using THeaderTransport. Ensure no untrusted networks directly reach these endpoints; restrict access to trusted internal IPs only. Within 7 days, implement anomaly detection rules to monitor for unusual memory access patterns or crashes in Thrift services. Investigate hardening options such as enabling ASLR and using sandboxing (e.g., containers with reduced capabilities). Within 30 days, coordinate with vendors or open-source maintainers for patch timelines; if no patch emerges, plan to migrate affected Thrift components to alternative communication protocols or apply runtime memory protections (e.g., address sanitizers in testing environments).

Apache Thrift CVE-2026-55970

Q: What is the CVSS score of CVE-2026-55970?

CVE-2026-55970 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-49154 MEDIUM

Buffer Over-read (CWE-126)

2026-07-24

GHSA-g7xp-pggm-c7w2

Buffer Overflow Apache Red Hat Suse Thrift

6.9

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Remote unauthenticated attacker can trigger over-read with crafted packet, potentially leaking memory and crashing the service.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 27, 2026 - 12:16 EUVD

Analysis Generated

Jul 26, 2026 - 12:08 vuln.today

CVE Published

Jul 24, 2026 - 22:45 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Heap out-of-bounds read in Apache Thrift's C++ THeaderTransport::readHeaderFormat() allows remote attackers to read unintended memory contents, potentially leading to information disclosure or denial of service. All versions before 0.24.0 are affected. No public exploit code has been reported.

Technical ContextAI

The vulnerability lies in the C++ bindings of Apache Thrift, an RPC and serialization framework. Specifically, the THeaderTransport::readHeaderFormat() function, which handles binary header parsing, performs an out-of-bounds read on the heap. This class of bug (CWE-126) can expose sensitive memory contents or crash the process. The affected component is part of the core transport layer used in Thrift services across many distributed systems.

RemediationAI

Upgrade to Apache Thrift 0.24.0 or later. The official fix is included in that release; no workarounds are published. If immediate patching is not possible, consider network segmentation or strict access controls to limit exposure of Thrift services.