PT-2026-35699 · Apache · Apache Thrift

김범수 · Published 2026-04-28 · Updated 2026-06-10 · CVE-2026-41602

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.23.0

Description An integer overflow or wraparound issue exists in the Go language implementation of the TFramedTransport component in Apache Thrift. An integer overflow occurs when an arithmetic operation attempts to create a numeric value that is outside of the range that can be represented with a given number of digits.

Recommendations Upgrade to version 0.23.0.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BIT-THRIFT-2026-41602

CLEANSTART-2026-GA28186

CLEANSTART-2026-MJ26242

CLEANSTART-2026-VT65447

CVE-2026-41602

GHSA-WF45-Q9CH-Q8GH

OPENSUSE-SU-2026:10685-1

OPENSUSE-SU-2026:10692-1

OPENSUSE-SU-2026:10699-1

OPENSUSE-SU-2026:10744-1

OPENSUSE-SU-2026:20940-1

Affected Products

Apache Thrift

References · 123

• https://nvd.nist.gov/vuln/detail/CVE-2026-33186 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39883 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-21726 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34165 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32287 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-11579 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34986 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41602 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10692-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33762 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-41602 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10699-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-GOBINARY-CVE-2026-41602 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41602 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-VT65447 · Vendor Advisory