PT-2026-35685 · Apache · Apache Thrift

CVE-2026-41603

Published

2026-04-28

Updated

2026-07-27

CVSS v3.1

8.2

High

Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.23.0

Description Improper validation of certificates with host mismatch occurs in the Java TSSLTransportFactory hostname verification process.

Recommendations Upgrade to version 0.23.0.

Exploit

Fix

Missing Authentication

Improper Certificate Validation

Found an issue in the description? Have something to add? Feel free to write us 👾

BIT-THRIFT-2026-41603

CLEANSTART-2026-SH44648

CVE-2026-41603

SUSE-SU-2026:3056-1

SUSE-SU-2026:3057-1

Apache Thrift