Every CVESearch/Get API key

CVE-2026-41603

Apache Thrift has an issue with Java TSSLTransportFactory hostname verification

7.4 HighFix availableRejected

CVE-2026-41603 has been rejected by its source and should not be treated as a live vulnerability, published April 28, 2026. Fixed in org.apache.thrift:libthrift 0.23.0.

What does this mean?
Severity
7.4 HighCVSS 3.1, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0.23.0org.apache.thrift:libthrift +26 more

Description

This CVE ID is Rejected and will not be used. The record incorrectly described the affected language binding and fixed version. Use CVE-2026-66053, which was assigned to the vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Affected packages

Affected packages
PackageAffectedFixed
org.apache.thrift:libthrift
Maven
before 0.23.0
0.23.0
thrift
Alpine:v3.24
before 0.23.0-r0
0.23.0-r0
thrift
Bitnami
before 0.23.0
0.23.0
org.apache.thrift:libthrift
Maven
before 0.23.0, plus listed versions
0.10.00.11.00.12.00.13.00.14.0
Show 19 moreShow less
0.14.10.14.20.15.00.16.00.17.00.18.00.18.10.19.00.20.00.21.00.22.00.6.10.7.00.8.00.9.00.9.10.9.20.9.30.9.3-1
0.23.0
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
before 3.11.0-150200.6.18.1
3.11.0-150200.6.18.1
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
before 2.32.0-150200.6.12.1
2.32.0-150200.6.12.1
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
before 2.0.0-150200.6.12.1
2.0.0-150200.6.12.1
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
before 3.43.0-150200.6.12.1
3.43.0-150200.6.12.1
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
before 2.9.0-150200.6.23.1
2.9.0-150200.6.23.1
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
before 1.13.2-150200.6.12.1
1.13.2-150200.6.12.1
Show 17 moreShow less
Affected packages
PackageAffectedFixed
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
before 2.0.0-150200.6.17.1
2.0.0-150200.6.17.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
before 3.0.0-150200.6.18.1
3.0.0-150200.6.18.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
before 3.0.0-150200.6.15.1
3.0.0-150200.6.15.1
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 41 CVEs
before 3.0.0-150200.5.15.1
3.0.0-150200.5.15.1
terraform-provider-aws
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
before 3.11.0-150200.6.18.1
3.11.0-150200.6.18.1
terraform-provider-azurerm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
before 2.32.0-150200.6.12.1
2.32.0-150200.6.12.1
terraform-provider-external
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
before 2.0.0-150200.6.12.1
2.0.0-150200.6.12.1
terraform-provider-google
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
before 3.43.0-150200.6.12.1
3.43.0-150200.6.12.1
terraform-provider-helm
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
before 2.9.0-150200.6.23.1
2.9.0-150200.6.23.1
terraform-provider-kubernetes
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
before 1.13.2-150200.6.12.1
1.13.2-150200.6.12.1
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
before 2.0.0-150200.6.17.1
2.0.0-150200.6.17.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
before 3.0.0-150200.6.18.1
3.0.0-150200.6.18.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
before 3.0.0-150200.6.15.1
3.0.0-150200.6.15.1
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 41 CVEs
before 3.0.0-150200.5.15.1
3.0.0-150200.5.15.1
terraform-provider-susepubliccloud
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 11 CVEs
before 0.0.1-150100.3.14.1
0.0.1-150100.3.14.1
terraform-provider-susepubliccloud
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 11 CVEs
before 0.0.1-150100.3.14.1
0.0.1-150100.3.14.1
thrift
Ubuntu:25.10
All versions, plus listed versions
0.19.0-4build1
None known

What each source reports

GitHub Advisories Score usedGHSA-gf47-qgg5-9g9q7.4

Apache Thrift has an issue with Java TSSLTransportFactory hostname verification

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Record
GHSA-gf47-qgg5-9g9q
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295, CWE-297
Updated
2026-11-02
CVE ListNo score

This CVE ID is Rejected and will not be used. The record incorrectly described the affected language binding and fixed version. Use CVE-2026-66053, which was assigned to the vulnerability.

Record
CVE-2026-41603
Updated
2026-11-02
EUVDEUVD-2026-260217.4

This CVE ID is Rejected and will not be used. The record incorrectly described the affected language binding and fixed version. Use CVE-2026-66053, which was assigned to the vulnerability.

Record
EUVD-2026-26021
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
NVDNo score

Rejected reason: This CVE ID is Rejected and will not be used. The record incorrectly described the affected language binding and fixed version. Use CVE-2026-66053, which was assigned to the vulnerability.

Record
CVE-2026-41603
Updated
2026-11-02
OSV7.4

Apache Thrift: Java TSSLTransportFactory hostname verification

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Record
CVE-2026-41603
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-297, CWE-306
Updated
2026-11-02
OSVDEBIAN-CVE-2026-416037.4

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Record
DEBIAN-CVE-2026-41603
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-gf47-qgg5-9g9q7.4

Apache Thrift has an issue with Java TSSLTransportFactory hostname verification

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Record
GHSA-gf47-qgg5-9g9q
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295, CWE-297
Updated
2026-11-02
OSVUBUNTU-CVE-2026-416037.4

Rejected reason: This CVE ID is Rejected and will not be used. The record incorrectly described the affected language binding and fixed version. Use CVE-2026-66053, which was assigned to the vulnerability.

Record
UBUNTU-CVE-2026-41603
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-02
OSVALPINE-CVE-2026-41603No score

Rejected reason: This CVE ID is Rejected and will not be used. The record incorrectly described the affected language binding and fixed version. Use CVE-2026-66053, which was assigned to the vulnerability.

Record
ALPINE-CVE-2026-41603
Updated
2026-11-03
OSVBIT-thrift-2026-41603No score

Apache Thrift: Java TSSLTransportFactory hostname verification

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Record
BIT-thrift-2026-41603
Updated
2026-11-02
OSVSUSE-SU-2026:3056-1No score

Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues

  • CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).
  • CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241728).
  • CVE-2025-32386: helm: specially crafted chart archive can cause OOM termination (bsc#1241030).
  • CVE-2025-32387: helm: specially crafted JSON schema can cause a stack overflow (bsc#1241033).
  • CVE-2025-47911: golang.org/x/net/html: various algorithms have quadratic complexity when parsing HTML documents (bsc#1251365).
  • CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253508 bsc#1253517).
  • CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253980 bsc#1253983).
  • CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253797 bsc#1253799).
  • CVE-2025-58190: golang.org/x/net/html: specially crafted input can cause excessive memory consumption by html.ParseFragment (bsc#1251559).
  • CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267058).
  • CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files can lead to the consumption of corrupted files (bsc#1258096).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260139 bsc#1260149 bsc#1260180).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266477 bsc#1266482 bsc#1266541 bsc#1266547).
  • CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833, CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: golang.org/x/crypto/ssh: multiple issues in the crypto/ssh library (bsc#1266051 bsc#1266057 bsc#1266086 bsc#1266112 bsc#1266122 bsc#1266127 bsc#1266132 bsc#1266150 bsc#1266160).
  • CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264862 bsc#1264888 bsc#1264938).
  • CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263515).
  • CVE-2026-41603: github.com/apache/thrift: improper hostname verification in TSSLTransportFactory can lead to host mismatch (bsc#1263606).
  • CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read and application crash (bsc#1263445).
  • CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer overflow (bsc#1263411).
  • CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263357).
  • CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263313).
  • CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via stack exhaustion (bsc#1263247).
  • CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS…
Record
SUSE-SU-2026:3056-1
Updated
2026-11-02
OSVSUSE-SU-2026:3057-1No score

Security update for terraform-provider-susepubliccloud

This update for terraform-provider-susepubliccloud fixes the following issues

  • CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).
  • CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260180).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266477).
  • CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer overflow (bsc#1263515).
  • CVE-2026-41603: github.com/apache/thrift: improper hostname verification in TSSLTransportFactory can lead to host mismatch (bsc#1263606).
  • CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read and application crash (bsc#1263445).
  • CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer overflow (bsc#1263411).
  • CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib dispatch can lead to uncontrolled recursion and denial of service (bsc#1263357).
  • CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263316).
  • CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via stack exhaustion (bsc#1263247).
Record
SUSE-SU-2026:3057-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 104 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open