CVE-2026-41602
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk65th percentile - higher than 65% of all known CVEs
Summary
An integer overflow or wraparound vulnerability has been identified in the Go language implementation of TFramedTransport in Apache Thrift before version 0.23.0. This can lead to unexpected behavior or potential remote code execution.
Risk Assessment
The vulnerability could allow an attacker to remotely execute code or cause application crashes, leading to security breaches and service availability issues.
Recommendation
Update Apache Thrift to version 0.23.0 or later.
Other vulnerabilities in Apache Thrift
See all- CVE-2026-58662Critical
Improper validation of specified quantity in input and out-of-bounds read in Apache Thrift C++ bindings. Affects versions before 0.24.0.
- CVE-2026-58023Critical
A vulnerability in Apache Thrift c_glib bindings before version 0.24.0 causes an out-of-bounds read, potentially leading to data disclosure or crash.
- CVE-2026-55971Critical
Apache Thrift versions before 0.24.0 contain a heap-based buffer overflow vulnerability in the C++ bindings, potentially leading to crashes or remote code execution.
- CVE-2026-48144Critical
Apache Thrift versions before 0.24.0 contain a certificate validation vulnerability with host mismatch in the c_glib bindings, potentially enabling man-in-the-middle attacks.
- CVE-2026-66053Medium
A vulnerability in Apache Thrift Python bindings before version 0.24.0 involves improper validation of certificate with host mismatch, enabling man-in-the-middle attacks.
- CVE-2026-58389High
Allocation of resources without limits or throttling vulnerability in Apache Thrift Rust bindings. Affects versions before 0.24.0.
- CVE-2026-55970Medium
A vulnerability in Apache Thrift C++ bindings before version 0.24.0 causes a buffer over-read, potentially leading to data disclosure or crash.
- CVE-2026-55969High
Integer overflow or wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi, and Haxe bindings. Affects versions before 0.24.0.
- CVE-2026-55968High
Inefficient algorithmic complexity and allocation of resources without limits or throttling vulnerability in Apache Thrift Node.js bindings. Affects versions before 0.24.0.
- CVE-2026-49158High
Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Ruby bindings. Affects versions before 0.24.0.
Original NVD description (English source)
Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.