Red Hat Security Advisory

RHSA-2026:59396

RHEL AI 3.3 RPM runtime CVE fix - thrift

Released 2026-08-25 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AI 3.3 for RHEL 9 perl-thrift-1:0.15.0-7.el9ai, python3-thrift-1:0.15.0-7.el9ai, thrift-1:0.15.0-7.el9ai +3

TI-2026-40373 CVE-2026-55971 · GHSA-gwj4-q93m-wwqc

MEDIUM 50

Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00979 Published 2026-07-27 Fixed in 0.24.0 CWE-122

TI-2026-42227 CVE-2026-58662 · GHSA-x4w6-p6f8-24qw

MEDIUM 46

Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.01078 Published 2026-07-27 Fixed in 0.24.0 CWE-125

TI-2026-40371 CVE-2026-55969 · GHSA-x8jh-qfcv-fp29

MEDIUM 46

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0103 Published 2026-07-27 Partial fix · 0.24.0 CWE-190

TI-2026-35942 CVE-2026-48586 · GHSA-6h9h-5c4r-fqgf

MEDIUM 46

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0103 Published 2026-07-27 Partial fix · 0.24.0 CWE-409

TI-2026-40372 CVE-2026-55970 · GHSA-g7xp-pggm-c7w2

LOW 38

Buffer Over-read vulnerability in Apache Thrift C++ bindings.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00775 Published 2026-07-27 Partial fix · 0.24.0 CWE-126

TI-2026-30148 CVE-2026-41607 · GHSA-7gqw-825c-3842

LOW 37

Out-of-bounds Read vulnerability in Apache Thrift.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00896 Published 2026-04-28 Partial fix · 0.23.0 CWE-125

TI-2026-35581 CVE-2026-48145 · GHSA-p2c7-c4gw-678h

LOW 36

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00417 Published 2026-07-27 Fixed in 0.24.0 CWE-297