Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.4
CVE-2026-41603: Apache Thrift may accept mismatched TLS certificates
CVE-2026-41603 · published 6 months ago
Summary
Apache Thrift versions before 0.23.0 do not properly check that a TLS certificate matches the server name it claims to represent. This can let an attacker intercept or alter data without being detected. Update to version 0.23.0 or later to restore proper hostname verification.
What to do
- Update thrift to version 0.23.0.
- Update org.apache.thrift:libthrift to version 0.23.0.
- Update apache software foundation apache thrift to version 0.23.0 or later.
- Update apache thrift to version 0.23.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Bitnami | – | thrift |
< 0.23.0 Fix: upgrade to 0.23.0
|
| Debian:11 | debian | thrift | All versions |
| Debian:12 | debian | thrift | All versions |
| Debian:13 | debian | thrift | All versions |
| Debian:14 | debian | thrift | All versions |
| – | apache software foundation | apache thrift | < 0.23.0 |
| – | apache | thrift |
< 0.23.0 cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:* |
| maven | – | org.apache.thrift:libthrift |
< 0.23.0 Fix: upgrade to 0.23.0
|
Original advisory text
Apache Thrift has an issue with Java TSSLTransportFactory hostname verification
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-41603
- https://security-tracker.debian.org/tracker/CVE-2026-41603 Vendor Advisory
- https://github.com/advisories/GHSA-gf47-qgg5-9g9q
- https://github.com/apache/thrift/commit/0919c3d5506151514e283a63e1fe1ce83e2449d8
- https://github.com/apache/thrift/commit/a30c552bd0808b7e19f35ad30212ba7a9aee8c66
- https://github.com/apache/thrift/releases/tag/v0.23.0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41603... Vendor Advisory
- https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql
- http://www.openwall.com/lists/oss-security/2026/04/28/7
- https://access.redhat.com/errata/RHSA-2026:14885
- https://access.redhat.com/errata/RHSA-2026:21769
- https://access.redhat.com/errata/RHSA-2026:22347
- https://access.redhat.com/errata/RHSA-2026:22423
- https://access.redhat.com/errata/RHSA-2026:23345
- https://access.redhat.com/errata/RHSA-2026:24539
- https://access.redhat.com/security/cve/CVE-2026-41603
- https://bugzilla.redhat.com/show_bug.cgi?id=2463411
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41603.json
- https://access.redhat.com/errata/RHSA-2026:36882
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-297Improper Validation of Certificate with Host Mismatch
CWE-306Missing Authentication for Critical Function
CWE-295Improper Certificate Validation
Timeline
Published28 Apr 2026
Updated28 Oct 2026
First seen28 Apr 2026
Sources
DEBIAN-CVE-2026-41603 · OSV
CVE-2026-41603 · NVD
BIT-thrift-2026-41603 · OSV
CVE-2026-41603 · MITRE
GHSA-gf47-qgg5-9g9q · GHSA
CVE-2026-41603 · OSV
Track software like this
Free during beta