Skip to main content

Apache Thrift EUVDEUVD-2026-49149

| CVE-2026-48145 HIGH
Improper Validation of Certificate with Host Mismatch (CWE-297)
2026-07-24 GHSA-p2c7-c4gw-678h
Apache Information Disclosure Thrift Suse Red Hat
8.2
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
8.2 HIGH
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.4 HIGH

MITM requirement justifies AC:H; full confidentiality and integrity impact on intercepted communication, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Jul 27, 2026 - 12:16 EUVD
Analysis Generated
Jul 26, 2026 - 12:07 vuln.today
CVE Published
Jul 24, 2026 - 22:34 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

TLS hostname verification bypass in Apache Thrift C++ bindings allows man-in-the-middle interception of Thrift RPC communications. The vulnerability resides in the TSSLSocket matchName() function's handling of wildcard certificates per RFC 6125, permitting an attacker with a crafted certificate to impersonate a legitimate server. Upgrading to version 0.24.0 fixes the flaw; no active exploitation or public exploit has been identified at this time.

Technical ContextAI

Apache Thrift is a framework for scalable cross-language services development, using an interface definition language to define RPC services. The C++ bindings include TSSLSocket, which wraps TLS socket communication and performs hostname verification via a matchName() function. This function is responsible for comparing the server's X.509 certificate's Subject Alternative Name (SAN) or Common Name against the expected hostname, adhering to RFC 6125 rules including wildcard handling. A logic flaw in the implementation causes improper validation of certain wildcard patterns, effectively bypassing certificate hostname checks. The root cause class aligns with CWE-295 (Improper Certificate Validation).

RemediationAI

Upgrade to Apache Thrift 0.24.0, which contains the corrected matchName() implementation. No workarounds are specified; as a temporary measure, restrict network access to Thrift services to trusted segments and disable the use of wildcard certificates on servers until the upgrade is applied.

More in Thrift

View all
CVE-2021-24028 CRITICAL
9.8 Apr 14

An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code e
CVE-2026-55971 CRITICAL
9.3 Jul 24

Heap-based buffer overflow in Apache Thrift C++ THeaderTransport::untransform() allows remote code execution by sending

CVE-2026-48144 CRITICAL
9.1 Jul 24

Improper certificate validation in Apache Thrift c_glib TLS clients allows man-in-the-middle attackers to intercept or t
CVE-2026-58662 HIGH
8.7 Jul 24

Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an ou
CVE-2026-58389 HIGH
8.7 Jul 24

Denial of service vulnerability in Apache Thrift Rust bindings prior to 0.24.0 allows remote attackers to exhaust memory
CVE-2026-55969 HIGH
8.7 Jul 24

Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affe
CVE-2026-55968 HIGH
8.7 Jul 24

Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU r
CVE-2026-48586 HIGH
8.7 Jul 24

Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources b
CVE-2026-43871 HIGH
8.7 Jul 24

Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger in
CVE-2026-41604 HIGH
8.2 Apr 28

Out-of-bounds read vulnerability in Apache Thrift Swift implementation allows remote unauthenticated attackers to trigge
CVE-2019-3565 HIGH
7.5 May 06

Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers o
CVE-2019-3558 HIGH
7.5 May 06

Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. Rated

Same weakness CWE-297 – Improper Validation of Certificate with Host Mismatch

View all
CVE-2025-46408 CRITICAL POC
9.8
CVE-2017-2911 MEDIUM POC
5.9
CVE-2017-2912 MEDIUM POC
5.9
CVE-2026-59638 CRITICAL
9.3
CVE-2025-15079 MEDIUM POC
5.3
CVE-2026-15925 CRITICAL
9.2
CVE-2026-48144 CRITICAL
9.1
CVE-2025-68637 CRITICAL
9.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed

Share

EUVD-2026-49149 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy