CVE-2026-48144

CriticalCVSS 9.1

Published: 27/07/2026(UTC)Updated: 28/07/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

Apache Thrift versions before 0.24.0 contain a certificate validation vulnerability with host mismatch in the c_glib bindings, potentially enabling man-in-the-middle attacks.

Risk Assessment

An attacker could impersonate a trusted server and intercept or modify communication between Thrift client and server.

Recommendation

Update Apache Thrift to version 0.24.0 or later.

Original NVD description (English source)

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.