CVE-2026-85088
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The C++ and D libraries of Apache Thrift contain a certificate validation flaw where, upon a host name mismatch, subjectAltName dNSName entries are checked first and the Common Name is consulted afterwards despite the presence of dNSName entries. A non-matching dNSName yields a "skip" result instead of rejection, allowing a certificate with a matching Common Name to be accepted. This affects the C++ library from 0.7.0 through 0.24.0 and the D library from 0.9.0 through 0.24.0.
Risk Assessment
An attacker on the network path holding a certificate that chains to a trusted CA and whose Common Name matches the connected host name can impersonate the target host and intercept or modify TLS traffic. This is primarily a concern for deployments using a private or enterprise public-key infrastructure.
Recommendation
Upgrade Apache Thrift to version 0.25.0 for both the C++ and D libraries. Until the upgrade, verify that certificates in use do not rely on Common Name alone.
Other vulnerabilities in Apache Thrift
See all- CVE-2026-96289High
Apache Thrift PHP bindings before version 0.25.0 are vulnerable to uncontrolled recursion, which can lead to system overload or crashes.
- CVE-2026-96286High
Apache Thrift Perl bindings before version 0.25.0 have an uncaught exception vulnerability, which can lead to unexpected termination of the application.
- CVE-2026-96277High
Apache Thrift Ruby bindings before version 0.25.0 have an uncaught exception and improper handling of exceptional conditions vulnerability, which can lead to application crashes.
- CVE-2026-66859High
NULL pointer dereference and use of uninitialized variable vulnerability in Apache Thrift c_glib bindings. Affects versions before 0.25.0.
- CVE-2026-66858High
Vulnerability in the protocol skip routine in several Apache Thrift bindings that does not apply the recursion limit, allowing deep nesting of unknown fields to exhaust the stack. Affects Python C++ accelerator, PHP, Perl, Lua, Smalltalk, and OCaml libraries. Affects versions before 0.25.0.
- CVE-2026-66837High
Stack-based buffer overflow and integer overflow vulnerability in Apache Thrift PHP bindings. Affects versions before 0.25.0.
- CVE-2026-66081High
Access of uninitialized pointer vulnerability in Apache Thrift c_glib bindings. Affects versions before 0.25.0.
- CVE-2026-96294High
Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
- CVE-2026-96288High
Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
- CVE-2026-94653High
Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Original NVD description (English source)
Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the host name that was connected to. That comparison walks the subjectAltName dNSName entries first and consults the certificate Common Name afterwards. A name that does not match yields a "skip" result rather than a rejection, so a certificate whose subjectAltName entries are all present and all non-matching falls through to the Common Name, which can then satisfy the check. RFC 6125 section 6.4.4, and RFC 9525 section 2, require that the Common Name is not consulted when a dNSName subjectAltName is present. A certificate carrying subjectAltName entries for one name and a Common Name for another is therefore accepted for a connection to the second name. Exploitation requires an attacker positioned on the network path who holds a certificate that chains to a certificate authority in the client's trust store and whose Common Name matches the connected host name. Public certificate authorities have not issued on Common Name alone for many years, so this is principally a concern for deployments using a private or enterprise public-key infrastructure. This issue affects the C++ library of Apache Thrift from 0.7.0 through 0.24.0 and the D library from 0.9.0 through 0.24.0. Users should upgrade to 0.25.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS