PatchTheCVEthrift vulnerabilities and fixes
Recent CVEs affecting thrift, with upgrade or downgrade steps. 15 tracked.
thrift has 15 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 15. Most recent: 2026-07-27. Highest priority: CVE-2026-55971 (score 63/100).
- CVE-2026-55971 CRITICAL 9.8 UPGRADE Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: bef
- CVE-2026-58023 CRITICAL 9.1 UPGRADE Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0
- CVE-2026-58662 CRITICAL 9.1 UPGRADE Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bind
- CVE-2026-41608 HIGH 7.5 UPGRADE Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python binding
- CVE-2026-43871 HIGH 7.5 UPGRADE Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java
- CVE-2026-45112 HIGH 7.5 UPGRADE Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue
- CVE-2026-48586 HIGH 7.5 UPGRADE Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Pyt
- CVE-2026-49158 HIGH 7.5 UPGRADE Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings.
- CVE-2026-55968 HIGH 7.5 UPGRADE Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apac
- CVE-2026-55969 HIGH 7.5 UPGRADE Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe binding
- CVE-2026-58389 HIGH 7.5 UPGRADE Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue
- CVE-2026-48144 CRITICAL 9.1 UPGRADE Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This is
- CVE-2026-55970 MEDIUM 6.5 UPGRADE Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0
- CVE-2026-48145 HIGH 7.5 UPGRADE Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue
- CVE-2026-66053 MEDIUM 5.9 UPGRADE Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This is
FAQ
How do I fix thrift vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is thrift being exploited right now?
None of the tracked thrift CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which thrift CVE should I patch first?
CVE-2026-55971 currently ranks highest (63/100): Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: bef.