Read the docs
TI-2016-04675 Aliases CVE-2016-5397GHSA-r4m4-pmvw-m6j5

Command injection in Apache Thrift

Priority MEDIUM 48CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 5 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-77.

Summary

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.

Why it matters now

EPSS 0.06873 94th percentileScored 2026-11-07
Fix Partial Apache Thrift (Apache Software Foundation): 0.10.0github.com/apache/thrift (Go): 0.10.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Thriftbefore 0.10.00.10.0Patch availableCNA
—github.com/apache/thrift (Go)before 0.10.00.10.0Patch availableGHSA-r4m4-pmvw-m6j5
  • Apache Thrift VendorApache Affected before 0.10.0 Fixed in 0.10.0 Patch available CNA
  • github.com/apache/thrift (Go) Vendor— Affected before 0.10.0 Fixed in 0.10.0 Patch available GHSA-r4m4-pmvw-m6j5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*up to 0.9.3VulnerableApache
  • cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:* Versions up to 0.9.3 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Thrift (Apache Software Foundation) Fixed in 0.10.0
  • Fix · GHSA-r4m4-pmvw-m6j5 github.com/apache/thrift (Go) Fixed in 0.10.0 Advisory →

Red Hat 2 advisories

  • RHSA-2019:3140 Released 2019-10-17 · Red Hat rating Important
    Red Hat JBoss Data Virtualization 6.4.8 security update
    • Red Hat JBoss Data Virtualization 6.4.8
  • RHSA-2018:2669 Released 2018-09-11 · Red Hat rating Important
    Fuse 7.1 security update
    • Red Hat Fuse 7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Fuse Integration Service 2AffectedNo fix yet
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 11 (Ocata)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 12 (Pike)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat Fuse 7Fixed RHSA-2018:2669
Red Hat JBoss Data Virtualization 6.4.8Fixed RHSA-2019:3140
Not affected: 5 products
  • Red Hat Enterprise Linux 8
  • Red Hat JBoss Fuse 6
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat JBoss Operations Network 3
  • Red Hat OpenShift Enterprise 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-5397
  2. 2026-10-03 Alias added: GHSA-r4m4-pmvw-m6j5
  3. 2026-11-03 Fix available: Red Hat Fuse 7 · Red Hat

References

Advisory 5

Other 3

  • TI-2026-40373 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() CVSS 4.0CRITICAL 9.3
  • TI-2026-42227 Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass CVSS 4.0HIGH 8.7
  • TI-2026-42014 Apache Thrift: Rust binary protocol non-strict path missing string size limit CVSS 4.0HIGH 8.7
  • TI-2026-40371 Integer overflow in Apache Thrift CVSS 4.0HIGH 8.7
  • TI-2026-40370 Apache Thrift: Node.js quadratic-time DoS in server receive transports CVSS 4.0HIGH 8.7
  • TI-2026-35942 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift… CVSS 4.0HIGH 8.7
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences