PT-2026-35702 · Apache · Apache Thrift

Hasnain Lakhani · Published 2026-04-28 · Updated 2026-05-04 · CVE-2026-41606

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.23.0

Description Uncontrolled recursion occurs in Apache Thrift, which can lead to system instability or crashes when the software processes deeply nested data structures.

Recommendations Upgrade to version 0.23.0.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

BIT-THRIFT-2026-41606

CVE-2026-41606

OPENSUSE-SU-2026:10685-1

Affected Products

Apache Thrift

References · 20

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41606 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41606 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-41606 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-thrift-2026-41606 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41606 · Security Note
• https://ubuntu.com/security/CVE-2026-41606 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41606 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10685-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-41602 · Note
• https://twitter.com/infoflowcloud/status/2049228694514720808 · Twitter Post
• https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql · Vendor Advisory, Patch
• https://t.me/cveNotify/161232 · Telegram Post
• https://twitter.com/CVEnew/status/2049227577844191452 · Twitter Post
• https://suse.com/security/cve/CVE-2026-41606 · Note
• http://openwall.com/lists/oss-security/2026/04/28/3 · Note