PT-2026-64880 · Apache · Apache Thrift

CVE-2026-48144

·

Published

2026-07-27

·

Updated

2026-08-01

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0
Description Improper validation of certificates with host mismatch occurs in the Apache Thrift c glib bindings. This issue results in the TLS client failing to perform necessary hostname verification.
Recommendations Upgrade to version 0.24.0.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-297

Related Identifiers

AZL-94077
BIT-THRIFT-2026-48144
CVE-2026-48144
ECHO-6A0A-2BD6-9321
OPENSUSE-SU-2026:11432-1

Affected Products

Apache Thrift