Read the docs
TI-2026-35942 Aliases CVE-2026-48586GHSA-6h9h-5c4r-fqgf

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift…

Priority MEDIUM 46CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 24 fixed, 10 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0103 63rd percentileScored 2026-11-07
Fix Partial Apache Thrift (Apache Software Foundation): 0.24.0Red Hat: 63 advisoriesRed Hat: 24 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Thriftbefore 0.24.00.24.0Patch availableCNA
ApacheApache Thriftbefore 0.24.00.24.0Patch availableCNA
ApacheApache Thriftbefore 0.24.00.24.0Patch availableCNA
ApacheApache Thriftbefore 0.24.00.24.0Patch availableCNA
ApacheApache Thriftbefore 0.24.00.24.0Patch availableCNA
ApacheApache Thriftbefore 0.24.00.24.0Patch availableCNA
  • Apache Thrift VendorApache Affected before 0.24.0 Fixed in 0.24.0 Patch available CNA
  • Apache Thrift VendorApache Affected before 0.24.0 Fixed in 0.24.0 Patch available CNA
  • Apache Thrift VendorApache Affected before 0.24.0 Fixed in 0.24.0 Patch available CNA
  • Apache Thrift VendorApache Affected before 0.24.0 Fixed in 0.24.0 Patch available CNA
  • Apache Thrift VendorApache Affected before 0.24.0 Fixed in 0.24.0 Patch available CNA
  • Apache Thrift VendorApache Affected before 0.24.0 Fixed in 0.24.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*before 0.24.0VulnerableApache
  • cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:* Versions before 0.24.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Thrift (Apache Software Foundation) Fixed in 0.24.0
  • Fix · CNA Apache Thrift (Apache Software Foundation) Fixed in 0.24.0
  • Fix · CNA Apache Thrift (Apache Software Foundation) Fixed in 0.24.0
  • Fix · CNA Apache Thrift (Apache Software Foundation) Fixed in 0.24.0
  • Fix · CNA Apache Thrift (Apache Software Foundation) Fixed in 0.24.0
  • Fix · CNA Apache Thrift (Apache Software Foundation) Fixed in 0.24.0

Red Hat 63 advisories

  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:76043 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.7 security update
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:76041 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.7 security update
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
Show 60 more Red Hat advisories
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:73419 Released 2026-09-29 · Red Hat rating Important
    Multicluster Global Hub 1.6.6 security update
    • Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:73038 Released 2026-09-29 · Red Hat rating Important
    Multicluster Global Hub 1.8.2 security update
    • Multicluster Global Hub 1.8.2 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:72880 Released 2026-09-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/submariner-addon-rhel9
  • RHSA-2026:71597 Released 2026-09-24 · Red Hat rating Important
    Multicluster Global Hub 1.5.8 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:71401 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (ROCm 7.14)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rocm-7.14-rhel9
  • RHSA-2026:71399 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (CUDA 12.9)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:71398 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (Spyre)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:71396 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (CUDA 13.0)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:71397 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (Rubin)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rubin-rhel9
  • RHSA-2026:71395 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (Gaudi)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:71394 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (TPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:71393 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (CPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:71392 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (Neuron)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:69935 Released 2026-09-22 · Red Hat rating Important
    Red Hat AI Base Images 3.4.2 (ROCm 6.4)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-6.4-rhel9
  • RHSA-2026:69934 Released 2026-09-22 · Red Hat rating Important
    Red Hat AI Base Images 3.4.2 (CUDA 13.0)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:69933 Released 2026-09-22 · Red Hat rating Important
    Red Hat AI Base Images 3.4.2 (CUDA 12.9)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:69932 Released 2026-09-22 · Red Hat rating Important
    Red Hat AI Base Images 3.4.2 (ROCm 7.1)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-7.1-rhel9
  • RHSA-2026:69931 Released 2026-09-22 · Red Hat rating Important
    Red Hat AI Base Images 3.4.2 (Spyre)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:69930 Released 2026-09-22 · Red Hat rating Important
    Red Hat AI Base Images 3.4.2 (Gaudi)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:69929 Released 2026-09-22 · Red Hat rating Important
    Red Hat AI Base Images 3.4.2 (CPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:69927 Released 2026-09-22 · Red Hat rating Important
    Red Hat AI Base Images 3.4.2 (TPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:68710 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Base Images 3.3.3 (CUDA)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:68709 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Base Images 3.3.3 (Spyre)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:68708 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Base Images 3.3.3 (CPU)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:68699 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.7 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:68698 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.7 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:68697 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.7 (Spyre)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-spyre-rhel9
  • RHSA-2026:68696 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.7 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:68639 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Base Images 3.3.3 (TPU)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:68638 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Base Images 3.3.3 (CUDA 13.0)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:68637 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Base Images 3.3.3 (ROCm 7.0)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-rocm-7.0-rhel9
  • RHSA-2026:68640 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Base Images 3.3.3 (ROCm 6.4)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-rocm-6.4-rhel9
  • RHSA-2026:68634 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Base Images 3.3.3 (Neuron)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:68515 Released 2026-09-17 · Red Hat rating Important
    Multicluster Global Hub 1.8.2 security update
    • Multicluster Global Hub 1.8.2 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:68333 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9 +5
  • RHSA-2026:67842 Released 2026-09-16 · Red Hat rating Important
    Multicluster Global Hub 1.7.3 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:67542 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +5
  • RHSA-2026:67541 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.7 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +9
  • RHSA-2026:67540 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.12 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +5
  • RHSA-2026:67539 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +7
  • RHSA-2026:67538 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.12 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/grafana-dashboard-loader-rhel9 +8
  • RHSA-2026:67516 Released 2026-09-15 · Red Hat rating Important
    Multicluster Global Hub 1.4.9 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
  • RHSA-2026:65542 Released 2026-09-08 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.11.0 release
    • Red Hat OpenShift distributed tracing 3.11 registry.redhat.io/rhosdt/opentelemetry-collector-rhel9
  • RHSA-2026:65343 Released 2026-09-08 · Red Hat rating Important
    Red Hat OpenShift distributed tracing platform (Tempo) 3.11.0 release
    • Red Hat OpenShift distributed tracing 3.11 registry.redhat.io/rhosdt/tempo-gateway-rhel9, registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9, registry.redhat.io/rhosdt/tempo-query-rhel9 +2
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:61629 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:61628 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:61627 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:60386 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31
  • RHSA-2026:59396 Released 2026-08-25 · Red Hat rating Important
    RHEL AI 3.3 RPM runtime CVE fix - thrift
    • Red Hat Enterprise Linux AI 3.3 for RHEL 9 perl-thrift-1:0.15.0-7.el9ai, python3-thrift-1:0.15.0-7.el9ai, thrift-1:0.15.0-7.el9ai +3
  • RHSA-2026:59395 Released 2026-08-25 · Red Hat rating Important
    RHEL AI 3.4 RPM runtime CVE fix - thrift
    • Red Hat Enterprise Linux AI 3.4 for RHEL 9 perl-thrift-1:0.15.0-7.el9ai, python3-thrift-1:0.15.0-7.el9ai, thrift-1:0.15.0-7.el9ai +3
  • RHSA-2026:54776 Released 2026-08-13 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.GA)
    • Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
  • RHSA-2026:46989 Released 2026-07-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images tempo3.0-3.0.2-0.2.hum1@aarch64, tempo3.0-3.0.2-0.2.hum1@src, tempo3.0-3.0.2-0.2.hum1@x86_64
  • RHSA-2026:46987 Released 2026-07-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images tempo2.10-2.10.7-0.2.hum1@aarch64, tempo2.10-2.10.7-0.2.hum1@src, tempo2.10-2.10.7-0.2.hum1@x86_64
  • RHSA-2026:46974 Released 2026-07-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images jaeger-2.20.0-0.5.hum1@aarch64, jaeger-2.20.0-0.5.hum1@src, jaeger-2.20.0-0.5.hum1@x86_64
  • RHSA-2026:46931 Released 2026-07-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images jaeger-2.20.0-0.4.hum1@aarch64, jaeger-2.20.0-0.4.hum1@src, jaeger-2.20.0-0.4.hum1@x86_64
  • RHSA-2026:45780 Released 2026-07-25 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images loki3.7-3.7.4-0.1.hum1@aarch64, loki3.7-3.7.4-0.1.hum1@src, loki3.7-3.7.4-0.1.hum1@x86_64 +4
  • RHSA-2026:43799 Released 2026-07-22 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images opentelemetry-collector-0.157.0-0.1.hum1@aarch64, opentelemetry-collector-0.157.0-0.1.hum1@src, opentelemetry-collector-0.157.0-0.1.hum1@x86_64
  • RHSA-2026:43581 Released 2026-07-22 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images opentelemetry-collector-contrib-0.157.0-0.1.hum1@aarch64, opentelemetry-collector-contrib-0.157.0-0.1.hum1@src, opentelemetry-collector-contrib-0.157.0-0.1.hum1@x86_64

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache Thrift — lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9

    15 records Highest priority Priority MEDIUM 10 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-40373 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()Priority MEDIUM 50
    • TI-2026-42227 Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypassPriority MEDIUM 46
    • TI-2026-42014 Apache Thrift: Rust binary protocol non-strict path missing string size limitPriority MEDIUM 46
    Show all 15 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Ceph Storage 5AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 6AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Connectivity Link 1AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Cryostat 4 on RHEL 9Fixed RHSA-2026:68333
Multicluster Global Hub 1.4.9Fixed RHSA-2026:67516
Multicluster Global Hub 1.5.8Fixed RHSA-2026:71597
Multicluster Global Hub 1.6.6Fixed RHSA-2026:73419
Multicluster Global Hub 1.7.4Fixed RHSA-2026:67842
Multicluster Global Hub 1.8.2Fixed RHSA-2026:68515, RHSA-2026:73038
Red Hat AI Inference Server 3.2Fixed RHSA-2026:61627, RHSA-2026:61628, RHSA-2026:61629
Red Hat AI Inference Server 3.3Fixed RHSA-2026:68696, RHSA-2026:68697, RHSA-2026:68698, RHSA-2026:68699
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:67538
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:67540
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:67539
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:67541
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:67542, RHSA-2026:72880
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:60386
Red Hat Build of Apache Camel 4.18 for Quarkus 3.33Fixed RHSA-2026:54776
Red Hat Enterprise Linux AI 3.3Fixed RHSA-2026:76041, RHSA-2026:76043
Red Hat Enterprise Linux AI 3.3 for RHEL 9Fixed RHSA-2026:59396
Red Hat Enterprise Linux AI 3.4 for RHEL 9Fixed RHSA-2026:59395
Red Hat Hardened ImagesFixed RHSA-2026:43581, RHSA-2026:43799, RHSA-2026:45780, RHSA-2026:46931, RHSA-2026:46974, RHSA-2026:46987, RHSA-2026:46989
Red Hat OpenShift AI 2.25Fixed RHSA-2026:65126
Red Hat OpenShift AI 3.3Fixed RHSA-2026:68634, RHSA-2026:68637, RHSA-2026:68638, RHSA-2026:68639, RHSA-2026:68640, RHSA-2026:68708, RHSA-2026:68709, RHSA-2026:68710, RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:69927, RHSA-2026:69929, RHSA-2026:69930, RHSA-2026:69931, RHSA-2026:69932, RHSA-2026:69933, RHSA-2026:69934, RHSA-2026:69935, RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:71392, RHSA-2026:71393, RHSA-2026:71394, RHSA-2026:71395, RHSA-2026:71396, RHSA-2026:71397, RHSA-2026:71398, RHSA-2026:71399, RHSA-2026:71401
Red Hat OpenShift distributed tracing 3.11Fixed RHSA-2026:65343, RHSA-2026:65542
Not affected: 24 products
  • Confidential Compute Attestation
  • Cryostat 4 on RHEL 9
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.5.8
  • Multicluster Global Hub 1.6.6
  • Multicluster Global Hub 1.7.4
  • Multicluster Global Hub 1.8.2
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17
  • Red Hat Data Grid 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Update Service
  • Red Hat OpenShift distributed tracing 3.11
  • Red Hat OpenStack Platform 18.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48586
  2. 2026-10-03 Alias added: GHSA-6h9h-5c4r-fqgf
  3. 2026-10-06 Fix available: RHSA-2026:76043 · Red Hat
  4. 2026-10-06 Fix available: RHSA-2026:76041 · Red Hat
  5. 2026-10-06 Fix available: Red Hat Enterprise Linux AI 3.3 · Red Hat
  6. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  7. 2026-10-09 Affected versions changed · Red Hat
  8. 2026-10-10 Fix available: Red Hat OpenShift distributed tracing 3.11.2 · Red Hat
  9. 2026-10-15 Fix available: Red Hat OpenShift distributed tracing 3.11 · Red Hat
  10. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  11. 2026-10-20 Affected versions changed · Red Hat
  12. 2026-10-24 Fix available: Red Hat OpenShift distributed tracing 3.11.3 · Red Hat
  13. 2026-10-26 Fix available: Red Hat OpenShift distributed tracing 3.11 · Red Hat
  14. 2026-10-31 Affected versions changed · Red Hat
  15. 2026-11-06 Fix available: Multicluster Global Hub 1.7.4, Red Hat Enterprise Linux AI 3.3 for RHEL 9, Red Hat Enterprise Linux AI 3.4 for RHEL 9 · Red Hat
  16. 2026-11-06 Fix available: RHSA-2026:59395 · Red Hat
  17. 2026-11-06 Fix available: RHSA-2026:59396 · Red Hat

References

Advisory 3

  • TI-2026-40373 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() CVSS 4.0CRITICAL 9.3
  • TI-2016-04675 Command injection in Apache Thrift CVSS 3.0HIGH 8.8
  • TI-2026-42227 Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass CVSS 4.0HIGH 8.7
  • TI-2026-42014 Apache Thrift: Rust binary protocol non-strict path missing string size limit CVSS 4.0HIGH 8.7
  • TI-2026-40371 Integer overflow in Apache Thrift CVSS 4.0HIGH 8.7
  • TI-2026-40370 Apache Thrift: Node.js quadratic-time DoS in server receive transports CVSS 4.0HIGH 8.7
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences