{"id":"CVE-2026-41605","aliases":["ALPINE-CVE-2026-41605","AZL-85026","BIT-thrift-2026-41605","DEBIAN-CVE-2026-41605","EUVD-2026-26023","GHSA-qcp3-xfwx-5hr4","SUSE-SU-2026:3056-1","SUSE-SU-2026:3057-1","UBUNTU-CVE-2026-41605","openSUSE-SU-2026:10685-1"],"status":"published","title":"Apache Thrift: Swift Compact Protocol integer overflow","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0093,"percentile":0.61075,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-04-28T09:20:44Z","modified":"2026-11-03T06:32:55Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"thrift","fixed_in":["0.23.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"thrift","fixed_in":["0.15.0-6"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"thrift","fixed_in":["0.23.0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thrift","fixed_in":["0.23.0-3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-6"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"thrift","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.0-2","0.17.0-3","0.17.0-4","0.18.1-1","0.18.1-2","0.19.0-1","0.19.0-2","0.19.0-2.1","0.19.0-2.1~exp1","0.19.0-3","0.19.0-4","0.20.0-1","0.22.0-1","0.22.0-2","0.22.0-3","0.22.0-4","0.23.0-1","0.23.0-2","0.23.0-3","0.24.0-1","0.24.0-2","0.24.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-4","0.20.0-1","0.22.0-1","0.22.0-2","0.22.0-3","0.22.0-4","0.23.0-1","0.23.0-2","0.23.0-3","0.24.0-1","0.24.0-2","0.24.0-3"]},{"source":"osv","ecosystem":"Debian:14","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-3"}]}],"versions":["0.19.0-4","0.20.0-1","0.22.0-1","0.22.0-2","0.22.0-3","0.22.0-4","0.23.0-1","0.23.0-2"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.23.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.17.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-azurerm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.43.0-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-150200.6.23.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-150200.6.12.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-local","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-150200.6.17.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-null","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.18.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-random","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.6.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-150200.5.15.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-susepubliccloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.1-150100.3.14.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-susepubliccloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.1-150100.3.14.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.0-6","0.13.0-2build1","0.13.0-2build2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.0-6ubuntu1","0.13.0-6ubuntu2","0.13.0-6ubuntu3","0.13.0-7","0.16.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.0-4","0.19.0-2","0.19.0-2build1","0.19.0-2.1build4","0.19.0-2.1build5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-4build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.0-3ubuntu1","0.23.0-3","0.23.0-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-4build1","0.22.0-3","0.22.0-3ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-1.1"}]}],"bundled":6}],"products":[{"vendor":"apache","product":"thrift"},{"vendor":"apache software foundation","product":"apache thrift"},{"vendor":"red hat","product":"multicluster global hub 1.3.4"},{"vendor":"red hat","product":"multicluster global hub 1.4.5"},{"vendor":"red hat","product":"multicluster global hub 1.6.5"},{"vendor":"red hat","product":"openshift service mesh 2"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.14"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.15"},{"vendor":"red hat","product":"red hat ai inference server"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat multicluster global hub 1.5.3"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift distributed tracing 3"},{"vendor":"red hat","product":"red hat openshift distributed tracing 3.9.3"},{"vendor":"red hat","product":"red hat openshift gitops"}],"references":[{"url":"https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql","tags":["vendor-advisory","Mailing List","Patch","Release Notes","fix","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/28/4","tags":["Mailing List","discussion","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41605","tags":["vdb-entry","x_refsource_REDHAT","web","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463418","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41605.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22423","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22347","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23345","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36882","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24539","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14885","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21769","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41605","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qcp3-xfwx-5hr4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-41605","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41605.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41605","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263056-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208300","tags":["report"]},{"url":"https://bugzilla.suse.com/1241030","tags":["report"]},{"url":"https://bugzilla.suse.com/1241033","tags":["report"]},{"url":"https://bugzilla.suse.com/1241728","tags":["report"]},{"url":"https://bugzilla.suse.com/1251365","tags":["report"]},{"url":"https://bugzilla.suse.com/1251559","tags":["report"]},{"url":"https://bugzilla.suse.com/1253508","tags":["report"]},{"url":"https://bugzilla.suse.com/1253517","tags":["report"]},{"url":"https://bugzilla.suse.com/1253797","tags":["report"]},{"url":"https://bugzilla.suse.com/1253799","tags":["report"]},{"url":"https://bugzilla.suse.com/1253980","tags":["report"]},{"url":"https://bugzilla.suse.com/1253983","tags":["report"]},{"url":"https://bugzilla.suse.com/1258096","tags":["report"]},{"url":"https://bugzilla.suse.com/1260139","tags":["report"]},{"url":"https://bugzilla.suse.com/1260149","tags":["report"]},{"url":"https://bugzilla.suse.com/1260180","tags":["report"]},{"url":"https://bugzilla.suse.com/1263247","tags":["report"]},{"url":"https://bugzilla.suse.com/1263313","tags":["report"]},{"url":"https://bugzilla.suse.com/1263357","tags":["report"]},{"url":"https://bugzilla.suse.com/1263411","tags":["report"]},{"url":"https://bugzilla.suse.com/1263445","tags":["report"]},{"url":"https://bugzilla.suse.com/1263515","tags":["report"]},{"url":"https://bugzilla.suse.com/1263606","tags":["report"]},{"url":"https://bugzilla.suse.com/1264862","tags":["report"]},{"url":"https://bugzilla.suse.com/1264888","tags":["report"]},{"url":"https://bugzilla.suse.com/1264938","tags":["report"]},{"url":"https://bugzilla.suse.com/1266051","tags":["report"]},{"url":"https://bugzilla.suse.com/1266057","tags":["report"]},{"url":"https://bugzilla.suse.com/1266086","tags":["report"]},{"url":"https://bugzilla.suse.com/1266112","tags":["report"]},{"url":"https://bugzilla.suse.com/1266122","tags":["report"]},{"url":"https://bugzilla.suse.com/1266127","tags":["report"]},{"url":"https://bugzilla.suse.com/1266132","tags":["report"]},{"url":"https://bugzilla.suse.com/1266150","tags":["report"]},{"url":"https://bugzilla.suse.com/1266160","tags":["report"]},{"url":"https://bugzilla.suse.com/1266477","tags":["report"]},{"url":"https://bugzilla.suse.com/1266482","tags":["report"]},{"url":"https://bugzilla.suse.com/1266541","tags":["report"]},{"url":"https://bugzilla.suse.com/1266547","tags":["report"]},{"url":"https://bugzilla.suse.com/1267058","tags":["report"]},{"url":"https://bugzilla.suse.com/1267271","tags":["report"]},{"url":"https://bugzilla.suse.com/1267273","tags":["report"]},{"url":"https://bugzilla.suse.com/1267276","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263057-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1263316","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-41605","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41605","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/28/4","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-41605","title":"Apache Thrift: Swift Compact Protocol integer overflow","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T09:20:44.319Z","modified":"2026-09-09T12:04:44.636Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-190","CWE-190"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-26023","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T09:20:44Z","modified":"2026-09-09T12:04:44Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:27.763941Z"}],"ghsa":[{"id":"GHSA-qcp3-xfwx-5hr4","title":"Integer Overflow or Wraparound vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift:...","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T12:31:30Z","modified":"2026-07-09T15:32:01Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:09:21.623271Z"}],"nvd":[{"id":"CVE-2026-41605","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T10:16:03.35Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:12:16.252509Z"}],"osv":[{"id":"ALPINE-CVE-2026-41605","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T10:16:03.35Z","modified":"2026-11-03T06:32:55.488145869Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"CVE-2026-41605","title":"Apache Thrift: Swift Compact Protocol integer overflow","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T09:20:44.319Z","modified":"2026-10-28T02:30:27.449483196Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"DEBIAN-CVE-2026-41605","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift.  This issue affects Apache Thrift: before 0.23.0.  Users are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T10:16:03.35Z","modified":"2026-10-27T10:01:19.545979126Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"UBUNTU-CVE-2026-41605","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T10:16:00Z","modified":"2026-10-17T12:58:15.522974161Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"AZL-85026","title":"CVE-2026-41605 affecting package thrift for versions less than 0.15.0-6","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-28T10:16:03Z","modified":"2026-08-28T17:56:32.174149Z","updated_at":"2026-11-02T15:28:10.335477Z"},{"id":"BIT-thrift-2026-41605","title":"Apache Thrift: Swift Compact Protocol integer overflow","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-04-29T08:50:23.42Z","modified":"2026-09-10T16:01:47.664461792Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"openSUSE-SU-2026:10685-1","title":"libthrift-0_23_0-0.23.0-1.1 on GA media","description":"These are all security issues fixed in the libthrift-0_23_0-0.23.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-04T00:00:00Z","modified":"2026-05-05T07:47:08.345774Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"SUSE-SU-2026:3056-1","title":"Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls","description":"This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues\n\n- CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).\n- CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during\n  DOM construction (bsc#1241728).\n- CVE-2025-32386: helm: specially crafted chart archive can cause OOM termination (bsc#1241030).\n- CVE-2025-32387: helm: specially crafted JSON schema can cause a stack overflow (bsc#1241033).\n- CVE-2025-47911: golang.org/x/net/html: various algorithms have quadratic complexity when parsing HTML documents\n  (bsc#1251365).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type\n  in response to a key listing or signing request (bsc#1253508 bsc#1253517).\n- CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds\n  read (bsc#1253980 bsc#1253983).\n- CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption\n  (bsc#1253797 bsc#1253799).\n- CVE-2025-58190: golang.org/x/net/html: specially crafted input can cause excessive memory consumption by\n  `html.ParseFragment` (bsc#1251559).\n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues\n  when parsing HTML files (bsc#1267058).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for `.pack` and `.idx`\n  files can lead to the consumption of corrupted files (bsc#1258096).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 `:path` \n  pseudo-header (bsc#1260139 bsc#1260149 bsc#1260180).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266477 bsc#1266482 bsc#1266541 bsc#1266547).\n- CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,\n  CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598:\n  golang.org/x/crypto/ssh: multiple issues in the crypto/ssh library (bsc#1266051 bsc#1266057 bsc#1266086 bsc#1266112\n  bsc#1266122 bsc#1266127 bsc#1266132 bsc#1266150 bsc#1266160).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n  smart-HTTP clone and fetch operations (bsc#1264862 bsc#1264888 bsc#1264938).\n- CVE-2026-41602: github.com/apache/thrift: `TFramedTransport` frame size headers can lead to a `uint32` integer\n  overflow (bsc#1263515).\n- CVE-2026-41603: github.com/apache/thrift: improper hostname verification in `TSSLTransportFactory` can lead to host\n  mismatch (bsc#1263606).\n- CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read\n  and application crash (bsc#1263445).\n- CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer\n  overflow (bsc#1263411).\n- CVE-2026-41606: github.com/apache/thrift: crafted nested messages in `c_glib` dispatch can lead to uncontrolled\n  recursion and denial of service (bsc#1263357).\n- CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an\n  out-of-bounds read and potential information disclosure (bsc#1263313).\n- CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service\n  via stack exhaustion (bsc#1263247).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via\n  infinite loops, panics or resource consumption (bsc#1267271 bsc#1267273 bsc#1267276).\n","status":"published","published":"2026-07-15T13:28:46Z","modified":"2026-07-16T10:00:15.0086061Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3057-1","title":"Security update for terraform-provider-susepubliccloud","description":"This update for terraform-provider-susepubliccloud fixes the following issues\n\n- CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 `:path`\n  pseudo-header (bsc#1260180).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266477).\n- CVE-2026-41602: github.com/apache/thrift: `TFramedTransport` frame size headers can lead to a `uint32` integer\n  overflow (bsc#1263515).\n- CVE-2026-41603: github.com/apache/thrift: improper hostname verification in `TSSLTransportFactory` can lead to host\n  mismatch (bsc#1263606).\n- CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read\n  and application crash (bsc#1263445).\n- CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer\n  overflow (bsc#1263411).\n- CVE-2026-41606: github.com/apache/thrift: crafted nested messages in `c_glib` dispatch can lead to uncontrolled\n  recursion and denial of service (bsc#1263357).\n- CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds\n  read and potential information disclosure (bsc#1263316).\n- CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via\n  stack exhaustion (bsc#1263247).\n","status":"published","published":"2026-07-15T13:30:06Z","modified":"2026-07-16T10:00:14.969281344Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}