Read the docs
TI-2026-31934 Aliases CVE-2026-43870GHSA-526f-jxpj-jmg2

Apache Thrift: Node.js web_server.js multi-vulnerability

Priority LOW 38CWE-113Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Denial of service
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Partial Red Hat: 9 fixed, 7 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-346 and CWE-400.

Summary

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Fix Partial Apache Thrift (Apache Software Foundation): 0.23.0Red Hat: 10 advisoriesRed Hat: 9 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Thriftbefore 0.23.00.23.0Patch availableCNA
—thrift (npm)up to 0.22.0—No fix listedGHSA-526f-jxpj-jmg2
  • Apache Thrift VendorApache Affected before 0.23.0 Fixed in 0.23.0 Patch available CNA
  • thrift (npm) Vendor— Affected up to 0.22.0 Fixed in — No fix listed GHSA-526f-jxpj-jmg2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*before 0.23.0VulnerableApache
  • cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:* Versions before 0.23.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Thrift (Apache Software Foundation) Fixed in 0.23.0

Red Hat 10 advisories

  • RHSA-2026:60390 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +23
  • RHSA-2026:53530 Released 2026-08-11 · Red Hat rating Critical
    Multicluster Global Hub 1.7.2 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:53415 Released 2026-08-11 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) opentelemetry-collector-0.152.1-1.el9_6
Show 7 more Red Hat advisories
  • RHSA-2026:53412 Released 2026-08-11 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) opentelemetry-collector-0.152.1-1.el9_4
  • RHSA-2026:53413 Released 2026-08-11 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) opentelemetry-collector-0.152.1-1.el10_0
  • RHSA-2026:47149 Released 2026-07-28 · Red Hat rating Important
    Multicluster Global Hub 1.7.2 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:44622 Released 2026-07-23 · Red Hat rating Important
    Multicluster Global Hub 1.6.4 security update
    • Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:42852 Released 2026-07-21 · Red Hat rating Important
    Multicluster Global Hub 1.5.6 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:41030 Released 2026-07-16 · Red Hat rating Important
    Multicluster Global Hub 1.4.7 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:36882 Released 2026-07-08 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +10

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Thrift 0.23.0

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-31933 Apache Thrift: TSSLTransportFactory.java hostname verificationPriority LOW 39
    • TI-2026-31932 Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 patternPriority LOW 31
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift distributed tracing 3AffectedNo fix yet
Zero Trust Workload Identity ManagerAffectedNo fix planned: Will not fix
Zero Trust Workload Identity Manager - Tech PreviewAffectedNo fix planned: Will not fix
Multicluster Global Hub 1.4.9Fixed RHSA-2026:41030
Multicluster Global Hub 1.5.8Fixed RHSA-2026:42852
Multicluster Global Hub 1.6.6Fixed RHSA-2026:44622
Multicluster Global Hub 1.7.4Fixed RHSA-2026:47149, RHSA-2026:53530
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:60390
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:36882
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:53412
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:53413
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:53415
Not affected: 18 products
  • Cryostat 4
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.5.8
  • Multicluster Global Hub 1.6.6
  • Multicluster Global Hub 1.7.4
  • OpenShift Service Mesh 2
  • Red Hat AI Inference Server
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenStack Platform 18.0
  • Red Hat build of Apache Camel 4 for Quarkus 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43870
  2. 2026-10-03 Alias added: GHSA-526f-jxpj-jmg2
  3. 2026-11-06 Fix available: Multicluster Global Hub 1.7.4 · Red Hat

References

Advisory 3

Other 3

  • TI-2026-40373 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() CVSS 4.0CRITICAL 9.3
  • TI-2016-04675 Command injection in Apache Thrift CVSS 3.0HIGH 8.8
  • TI-2026-42227 Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass CVSS 4.0HIGH 8.7
  • TI-2026-42014 Apache Thrift: Rust binary protocol non-strict path missing string size limit CVSS 4.0HIGH 8.7
  • TI-2026-40371 Integer overflow in Apache Thrift CVSS 4.0HIGH 8.7
  • TI-2026-40370 Apache Thrift: Node.js quadratic-time DoS in server receive transports CVSS 4.0HIGH 8.7
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences