CVE-2026-48145
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Improper validation of certificate with host mismatch in Apache Thrift C++ bindings. Affects versions before 0.24.0.
Risk Assessment
An attacker can perform a man-in-the-middle attack by impersonating a server, compromising confidentiality and integrity of communications.
Recommendation
Upgrade to Apache Thrift version 0.24.0.
Other vulnerabilities in Apache Thrift
See all- CVE-2026-58662Critical
Improper validation of specified quantity in input and out-of-bounds read in Apache Thrift C++ bindings. Affects versions before 0.24.0.
- CVE-2026-58023Critical
A vulnerability in Apache Thrift c_glib bindings before version 0.24.0 causes an out-of-bounds read, potentially leading to data disclosure or crash.
- CVE-2026-55971Critical
Apache Thrift versions before 0.24.0 contain a heap-based buffer overflow vulnerability in the C++ bindings, potentially leading to crashes or remote code execution.
- CVE-2026-48144Critical
Apache Thrift versions before 0.24.0 contain a certificate validation vulnerability with host mismatch in the c_glib bindings, potentially enabling man-in-the-middle attacks.
- CVE-2026-66053Medium
A vulnerability in Apache Thrift Python bindings before version 0.24.0 involves improper validation of certificate with host mismatch, enabling man-in-the-middle attacks.
- CVE-2026-58389High
Allocation of resources without limits or throttling vulnerability in Apache Thrift Rust bindings. Affects versions before 0.24.0.
- CVE-2026-55970Medium
A vulnerability in Apache Thrift C++ bindings before version 0.24.0 causes a buffer over-read, potentially leading to data disclosure or crash.
- CVE-2026-55969High
Integer overflow or wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi, and Haxe bindings. Affects versions before 0.24.0.
- CVE-2026-55968High
Inefficient algorithmic complexity and allocation of resources without limits or throttling vulnerability in Apache Thrift Node.js bindings. Affects versions before 0.24.0.
- CVE-2026-49158High
Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Ruby bindings. Affects versions before 0.24.0.
Original NVD description (English source)
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.