{"id":"CVE-2026-43870","aliases":["BIT-thrift-2026-43870","DEBIAN-CVE-2026-43870","EUVD-2026-27245","GHSA-526f-jxpj-jmg2","RHSA-2026:53412","RHSA-2026:53413","RHSA-2026:53415","UBUNTU-CVE-2026-43870"],"status":"published","title":"Apache Thrift: Node.js web_server.js multi-vulnerability","description":"Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00379,"percentile":0.32142,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-113","CWE-22","CWE-346","CWE-400"],"published":"2026-05-05T07:45:35Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"Bitnami","package":"thrift","fixed_in":["0.23.0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thrift","fixed_in":["0.23.0-3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.22.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"thrift","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.0-2","0.17.0-3","0.17.0-4","0.18.1-1","0.18.1-2","0.19.0-1","0.19.0-2","0.19.0-2.1","0.19.0-2.1~exp1","0.19.0-3","0.19.0-4","0.20.0-1","0.22.0-1","0.22.0-2","0.22.0-3","0.22.0-4","0.23.0-1","0.23.0-2","0.23.0-3","0.24.0-1","0.24.0-2","0.24.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-4","0.20.0-1","0.22.0-1","0.22.0-2","0.22.0-3","0.22.0-4","0.23.0-1","0.23.0-2","0.23.0-3","0.24.0-1","0.24.0-2","0.24.0-3"]},{"source":"osv","ecosystem":"Debian:14","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-3"}]}],"versions":["0.19.0-4","0.20.0-1","0.22.0-1","0.22.0-2","0.22.0-3","0.22.0-4","0.23.0-1","0.23.0-2"]},{"source":"osv","ecosystem":"npm","package":"thrift","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.22.0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.152.1-1.el9_4"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.152.1-1.el10_0"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"opentelemetry-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.152.1-1.el9_6"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.0-6","0.13.0-2build1","0.13.0-2build2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.0-6ubuntu1","0.13.0-6ubuntu2","0.13.0-6ubuntu3","0.13.0-7","0.16.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.0-4","0.19.0-2","0.19.0-2build1","0.19.0-2.1build4","0.19.0-2.1build5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-4build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.0-3ubuntu1","0.23.0-3","0.23.0-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"thrift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-4build1","0.22.0-3","0.22.0-3ubuntu1"]}],"products":[{"vendor":"apache","product":"thrift"},{"vendor":"apache software foundation","product":"apache thrift"}],"references":[{"url":"https://lists.apache.org/thread/pgtfq44ltc9t63kxcbqmwqzt45pnhqdy","tags":["vendor-advisory","Vendor Advisory","advisory","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/05/4","tags":["Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43870","tags":["web","advisory"]},{"url":"https://github.com/apache/thrift/commit/80184ddca4d4f60ac657bd82b2abc47269814f79","tags":["web"]},{"url":"https://github.com/apache/thrift/releases/tag/v0.23.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-526f-jxpj-jmg2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43870.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-43870","tags":["advisory"]},{"url":"https://github.com/apache/thrift","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53412","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466505","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466507","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466671","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484207","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53412.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25681","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25681","tags":["advisory"]},{"url":"https://go.dev/cl/781703","tags":["article"]},{"url":"https://go.dev/issue/79574","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5029","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27136","tags":["advisory"]},{"url":"https://go.dev/cl/781685","tags":["article"]},{"url":"https://go.dev/issue/79575","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5030","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27145","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27145","tags":["advisory"]},{"url":"https://go.dev/cl/783621","tags":["article"]},{"url":"https://go.dev/issue/79694","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5037","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33811","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33811","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33811","tags":["advisory"]},{"url":"https://go.dev/cl/767860","tags":["article"]},{"url":"https://go.dev/issue/78803","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4981","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39821","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","tags":["advisory"]},{"url":"https://go.dev/cl/767220","tags":["article"]},{"url":"https://go.dev/issue/78760","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5026","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42151","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42151","tags":["advisory"]},{"url":"https://github.com/prometheus/prometheus/pull/18587","tags":["article"]},{"url":"https://github.com/prometheus/prometheus/pull/18590","tags":["article"]},{"url":"https://github.com/prometheus/prometheus/releases/tag/v3.11.3","tags":["article"]},{"url":"https://github.com/prometheus/prometheus/releases/tag/v3.5.3","tags":["article"]},{"url":"https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42154","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42154","tags":["advisory"]},{"url":"https://github.com/prometheus/prometheus/pull/18584","tags":["article"]},{"url":"https://github.com/prometheus/prometheus/pull/18585","tags":["article"]},{"url":"https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43870","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43870","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53413","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53413.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53415","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53415.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-43870","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/05/4","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-43870","title":"Apache Thrift: Node.js web_server.js multi-vulnerability","description":"Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-05-05T07:45:35.699Z","modified":"2026-05-06T13:32:31.943Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-346","CWE-22","CWE-113","CWE-400"],"updated_at":"2026-11-02T13:37:25.103021Z"}],"euvd":[{"id":"EUVD-2026-27245","description":"Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-05-05T07:45:35Z","modified":"2026-05-06T13:32:31Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T19:05:16.683147Z"}],"ghsa":[{"id":"GHSA-526f-jxpj-jmg2","title":"Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource Consumption","description":"Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version [0.23.0](https://github.com/apache/thrift/releases/tag/v0.23.0), which fixes the issue.","status":"published","published":"2026-05-05T09:31:55Z","modified":"2026-05-08T19:24:08Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:40:04.762828Z"}],"nvd":[{"id":"CVE-2026-43870","description":"Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-05-05T09:16:04.34Z","modified":"2026-10-26T19:10:00.163Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-22","CWE-113","CWE-346","CWE-400"],"updated_at":"2026-11-02T14:12:17.022502Z"}],"osv":[{"id":"CVE-2026-43870","title":"Apache Thrift: Node.js web_server.js multi-vulnerability","description":"Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-05-05T07:45:35.699Z","modified":"2026-10-28T02:30:39.645913309Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-113","CWE-22","CWE-346","CWE-400"],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"DEBIAN-CVE-2026-43870","description":"Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.  This issue affects Apache Thrift: before 0.23.0.  Users are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-05-05T09:16:04.34Z","modified":"2026-10-27T10:01:30.233780091Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-526f-jxpj-jmg2","title":"Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource Consumption","description":"Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version [0.23.0](https://github.com/apache/thrift/releases/tag/v0.23.0), which fixes the issue.","status":"published","published":"2026-05-05T09:31:55Z","modified":"2026-09-10T03:50:45.563861252Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"RHSA-2026:53412","title":"Red Hat Security Advisory: opentelemetry-collector security update","status":"published","published":"2026-08-12T10:16:28Z","modified":"2026-10-20T10:10:51Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:53413","title":"Red Hat Security Advisory: opentelemetry-collector security update","status":"published","published":"2026-08-12T10:16:28Z","modified":"2026-10-20T10:10:52Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:53415","title":"Red Hat Security Advisory: opentelemetry-collector security update","status":"published","published":"2026-08-12T10:16:29Z","modified":"2026-10-20T10:10:53Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"UBUNTU-CVE-2026-43870","description":"Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-05-05T09:16:00Z","modified":"2026-10-17T13:00:06.797661452Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T16:56:22.075798Z"},{"id":"BIT-thrift-2026-43870","title":"Apache Thrift: Node.js web_server.js multi-vulnerability","description":"Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","status":"published","published":"2026-05-07T08:53:18.614Z","modified":"2026-09-08T08:48:20.819040084Z","updated_at":"2026-11-02T15:28:36.104787Z"}]}}