CVE-2026-41606
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
In Apache Thrift before version 0.23.0, an uncontrolled recursion vulnerability was found that could lead to denial of service. The issue is fixed in version 0.23.0.
Risk Assessment
An attacker can cause system overload via uncontrolled recursion, leading to service unavailability.
Recommendation
Upgrade Apache Thrift to version 0.23.0 or later.
Other vulnerabilities in Apache Thrift
See all- CVE-2026-58662Critical
Improper validation of specified quantity in input and out-of-bounds read in Apache Thrift C++ bindings. Affects versions before 0.24.0.
- CVE-2026-58023Critical
A vulnerability in Apache Thrift c_glib bindings before version 0.24.0 causes an out-of-bounds read, potentially leading to data disclosure or crash.
- CVE-2026-55971Critical
Apache Thrift versions before 0.24.0 contain a heap-based buffer overflow vulnerability in the C++ bindings, potentially leading to crashes or remote code execution.
- CVE-2026-48144Critical
Apache Thrift versions before 0.24.0 contain a certificate validation vulnerability with host mismatch in the c_glib bindings, potentially enabling man-in-the-middle attacks.
- CVE-2026-66053Medium
A vulnerability in Apache Thrift Python bindings before version 0.24.0 involves improper validation of certificate with host mismatch, enabling man-in-the-middle attacks.
- CVE-2026-58389High
Allocation of resources without limits or throttling vulnerability in Apache Thrift Rust bindings. Affects versions before 0.24.0.
- CVE-2026-55970Medium
A vulnerability in Apache Thrift C++ bindings before version 0.24.0 causes a buffer over-read, potentially leading to data disclosure or crash.
- CVE-2026-55969High
Integer overflow or wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi, and Haxe bindings. Affects versions before 0.24.0.
- CVE-2026-55968High
Inefficient algorithmic complexity and allocation of resources without limits or throttling vulnerability in Apache Thrift Node.js bindings. Affects versions before 0.24.0.
- CVE-2026-49158High
Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Ruby bindings. Affects versions before 0.24.0.
Original NVD description (English source)
Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS