PT-2026-35700 · Apache · Apache Thrift

Hasnain Lakhani · Published 2026-04-28 · Updated 2026-05-04 · CVE-2026-41604

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.23.0

Description An out-of-bounds read issue exists in Apache Thrift, which occurs when the software reads data outside the intended boundary of a buffer.

Recommendations Upgrade to version 0.23.0.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BIT-THRIFT-2026-41604

CVE-2026-41604

OPENSUSE-SU-2026:10685-1

Affected Products

Apache Thrift

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2026-41604 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-41604 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-41604 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10685-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-thrift-2026-41604 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41604 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41604 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41604 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-41602 · Note
• https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql · Vendor Advisory, Patch
• https://t.me/cveNotify/161230 · Telegram Post
• https://t.me/CVEtracker/52068 · Telegram Post
• https://suse.com/security/cve/CVE-2026-41636 · Note
• https://suse.com/security/cve/CVE-2026-41606 · Note
• https://suse.com/security/cve/CVE-2026-41604 · Note