PT-2026-64892 · Apache · Apache Thrift

CVE-2026-58662 · Published 2026-07-27 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0

Description An out-of-bounds read issue exists in the Apache Thrift C++ bindings due to improper validation of the specified quantity in the input. This occurs within the readString() function of the THeaderTransport class, where a bounds bypass can happen regarding the info-header length.

Recommendations Upgrade to version 0.24.0.

Fix

Out of bounds Read

Weakness Enumeration

CWE-1284

CWE-125

Related Identifiers

CVE-2026-58662

Affected Products

Apache Thrift

References · 5

• https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-58662 · Security Note
• https://lists.apache.org/thread/13mzvylr3r3nktxrh5k1h30ng1t1sw1d · Vendor Advisory
• https://t.me/CVEtracker/61336 · Telegram Post
• http://openwall.com/lists/oss-security/2026/07/24/45 · Note