PT-2026-64880 · Apache · Apache Thrift

CVE-2026-48144 · Published 2026-07-27 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0

Description Improper validation of certificates with host mismatch occurs in the Apache Thrift c glib bindings. This issue results in the TLS client failing to perform necessary hostname verification.

Recommendations Upgrade to version 0.24.0.

Fix

Weakness Enumeration

CWE-297

Related Identifiers

CVE-2026-48144

Affected Products

Apache Thrift

References · 5

• https://lists.apache.org/thread/2xoltfxgzf5jyhcwq6y07spts5cn6ppj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48144 · Security Note
• https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9 · Vendor Advisory
• https://t.me/CVEtracker/61324 · Telegram Post
• http://openwall.com/lists/oss-security/2026/07/24/35 · Note