PT-2026-35701 · Apache · Apache Thrift

Hasnain Lakhani · Published 2026-04-28 · Updated 2026-05-04 · CVE-2026-41605

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.23.0

Description An integer overflow or wraparound issue exists in Apache Thrift. This occurs when an arithmetic operation attempts to create a numeric value that is outside of the range that can be represented with a given number of bits, potentially causing the value to wrap around to a minimum or maximum value.

Recommendations Upgrade to version 0.23.0.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BIT-THRIFT-2026-41605

CVE-2026-41605

OPENSUSE-SU-2026:10685-1

Affected Products

Apache Thrift

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2026-41605 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41605 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10685-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41605 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-thrift-2026-41605 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41605 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41605 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41605 · Vendor Advisory
• https://twitter.com/CVEnew/status/2049227578930561025 · Twitter Post
• https://openwall.com/lists/oss-security/2026/04/28/4 · Note
• https://suse.com/security/cve/CVE-2026-41604 · Note
• http://openwall.com/lists/oss-security/2026/04/28/4 · Note
• https://t.me/cveNotify/161231 · Telegram Post
• https://suse.com/security/cve/CVE-2026-41636 · Note
• https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql · Vendor Advisory, Patch