What is the CVSS score of EUVD-2026-26024?

EUVD-2026-26024 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-26024?

Yes, a patch is available for EUVD-2026-26024. Update the affected software to the latest version immediately.

Apache Thrift EUVD-2026-26024

| CVE-2026-41606 MEDIUM

Uncontrolled Recursion (CWE-674)

2026-04-28

Node.js Denial Of Service Apache Thrift

5.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SUSE

MEDIUM

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch released

Apr 28, 2026 - 18:39 nvd

Patch available

Analysis Generated

Apr 28, 2026 - 15:24 vuln.today

CVSS changed

Apr 28, 2026 - 15:22 NVD

5.3 (MEDIUM)

Patch available

Apr 28, 2026 - 11:01 EUVD

EUVD ID Assigned

Apr 28, 2026 - 00:45 euvd

EUVD-2026-26024

Analysis Generated

Apr 28, 2026 - 00:45 vuln.today

CVE Published

Apr 28, 2026 - 00:45 nvd

MEDIUM 5.3

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Stack overflow in Apache Thrift c_glib dispatch mechanism allows remote attackers to trigger denial of service via crafted network requests. The vulnerability affects Apache Thrift versions prior to 0.23.0 and requires no authentication or user interaction, resulting in application crashes or service unavailability. Patch is available from the vendor.

Technical ContextAI

Apache Thrift is a cross-language serialization and RPC framework. The c_glib language binding provides C implementations for Thrift protocol handling. The vulnerability stems from unbounded recursion in the dispatch stack (CWE-674: Uncontrolled Recursion), where malicious or malformed Thrift protocol messages can cause stack exhaustion. The c_glib dispatch mechanism processes incoming requests without sufficient depth validation, allowing remote attackers to exhaust stack memory and crash the service. This is distinct from the related Node.js skip() recursion (CVE-2026-41636), Swift Range crash (CVE-2026-41604), and Swift integer overflow (CVE-2026-41605) disclosed simultaneously, indicating systemic recursion and bounds-checking issues across multiple Thrift language bindings.

RemediationAI

Upgrade Apache Thrift to version 0.23.0 or later. This is the vendor-released patch that addresses the stack overflow vulnerability in the c_glib dispatch mechanism. Organizations unable to upgrade immediately should implement network-level controls: restrict network access to Thrift service ports (typically 9090 for Thrift services) to trusted client IP ranges or internal networks only, and deploy network firewalling to prevent external attacker access. If service-level changes are feasible, disable the c_glib binding or migrate to alternative language bindings (Java, Python, Go) that do not exhibit this specific recursion flaw, though this may require architectural changes. Monitor service logs for repeated connection failures or crash patterns that indicate exploitation attempts. The workarounds come with trade-offs: network restriction reduces flexibility for distributed deployments, binding migration requires code rewrites, and crash monitoring adds operational overhead without preventing the vulnerability.

More in Node.js

View all

CVE-2024-55591 CRITICAL Emergency POC

9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote

CVE-2014-7205 CRITICAL Act Now POC

10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

CVE-2025-59528 CRITICAL Act Now POC

10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

CVE-2017-14849 HIGH Act Now POC

7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc

CVE-2017-5941 CRITICAL Emergency POC

9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner

CVE-2014-3744 HIGH Act Now POC

7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

CVE-2014-9566 HIGH Act Now POC

7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

CVE-2013-4660 MEDIUM This Month POC

6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

CVE-2015-5688 MEDIUM This Month POC

5.0 Sep 04

Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read

CVE-2026-45321 CRITICAL Act Now POC

9.6 May 12

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio

CVE-2014-7192 CRITICAL Act Now POC

10.0 Dec 11

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat

CVE-2013-4450 MEDIUM This Month POC

5.0 Oct 21

The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se

Same weakness CWE-674 – Uncontrolled Recursion

View all

CVE-2019-9545 HIGH POC

8.8

CVE-2019-9543 HIGH POC

8.8

CVE-2019-9144 HIGH POC

8.8

CVE-2019-9143 HIGH POC

8.8

CVE-2025-9624 HIGH POC

8.3

CVE-2021-28210 HIGH POC

7.8

CVE-2018-9918 HIGH POC

7.8

CVE-2025-57809 HIGH POC

7.7

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 12	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

EUVD-2026-26024 vulnerability details – vuln.today

Back

Apache Thrift EUVD-2026-26024

Severity by source

CVSS VectorVendor

Lifecycle Timeline

Description PRE-NVD

AnalysisAI

Technical ContextAI

RemediationAI

More in Node.js

Same weakness CWE-674 – Uncontrolled Recursion

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code