Is there a patch available for EUVD-2026-49148?

Yes, a patch is available for EUVD-2026-49148. Update the affected software to the latest version immediately.

Apache Thrift c_glib EUVD-2026-49148

Q: What is the CVSS score of EUVD-2026-49148?

EUVD-2026-49148 has a CVSS 4.0 base score of 9.1 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-48144 CRITICAL

Improper Validation of Certificate with Host Mismatch (CWE-297)

2026-07-24

GHSA-367h-9jj5-w29f

Apache Information Disclosure Thrift Suse

9.1

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.1 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.4 HIGH

Network attack with high complexity because MITM is required; client automatically connects so no user interaction; high data compromise.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 27, 2026 - 12:16 EUVD

Analysis Generated

Jul 26, 2026 - 12:07 vuln.today

CVE Published

Jul 24, 2026 - 22:32 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Improper certificate validation in Apache Thrift c_glib TLS clients allows man-in-the-middle attackers to intercept or tamper with communications by presenting a valid certificate for a different hostname. The vulnerability affects all c_glib bindings prior to version 0.24.0 and can lead to complete compromise of confidentiality and integrity of Thrift RPC traffic. No active exploitation or public exploit code has been reported, but the fix is available in version 0.24.0.

Technical ContextAI

Apache Thrift is a framework for scalable cross-language services development. The c_glib bindings provide a C language interface using GLib. The root cause is the absence of hostname verification in the TLS client implementation, making it susceptible to CWE-295 (Improper Certificate Validation). This occurs because the TLS handshake only checks whether the certificate is signed by a trusted CA, not whether the certificate's Common Name (CN) or Subject Alternative Name (SAN) matches the intended server hostname. This class of flaw is common in custom TLS libraries that omit the hostname check, which is mandatory per RFC 2818 for HTTPS and generally necessary for secure client-server authentication.

RemediationAI

Upgrade the c_glib bindings to Apache Thrift version 0.24.0, which implements proper hostname verification. Until the upgrade is performed, mitigate risk by ensuring that all Thrift communications occur over trusted networks only, such as within an internal VPN or using mutual TLS with pre-shared certificates for individual hosts. Disabling TLS hostname verification may also be acceptable if the server certificate is specifically pinned per host. These compensating controls require careful certificate management and may break connectivity if not uniformly applied. The vendor advisory can be found at https://thrift.apache.org/.