Read the docs
TI-2026-40371 Aliases CVE-2026-55969GHSA-x8jh-qfcv-fp29

Integer overflow in Apache Thrift

Priority MEDIUM 46CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 22 fixed, 10 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0103 63rd percentileScored 2026-11-07
Fix Partial Apache Thrift (Apache Software Foundation): 0.24.0Red Hat: 57 advisoriesRed Hat: 22 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Thriftbefore 0.24.00.24.0Patch availableCNA
ApacheApache Thriftbefore 0.24.00.24.0Patch availableCNA
ApacheApache Thriftbefore 0.24.00.24.0Patch availableCNA
ApacheApache Thriftbefore 0.24.00.24.0Patch availableCNA
ApacheApache Thriftbefore 0.24.00.24.0Patch availableCNA
ApacheApache Thriftbefore 0.24.00.24.0Patch availableCNA
  • Apache Thrift VendorApache Affected before 0.24.0 Fixed in 0.24.0 Patch available CNA
  • Apache Thrift VendorApache Affected before 0.24.0 Fixed in 0.24.0 Patch available CNA
  • Apache Thrift VendorApache Affected before 0.24.0 Fixed in 0.24.0 Patch available CNA
  • Apache Thrift VendorApache Affected before 0.24.0 Fixed in 0.24.0 Patch available CNA
  • Apache Thrift VendorApache Affected before 0.24.0 Fixed in 0.24.0 Patch available CNA
  • Apache Thrift VendorApache Affected before 0.24.0 Fixed in 0.24.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*before 0.24.0VulnerableApache
  • cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:* Versions before 0.24.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Thrift (Apache Software Foundation) Fixed in 0.24.0
  • Fix · CNA Apache Thrift (Apache Software Foundation) Fixed in 0.24.0
  • Fix · CNA Apache Thrift (Apache Software Foundation) Fixed in 0.24.0
  • Fix · CNA Apache Thrift (Apache Software Foundation) Fixed in 0.24.0
  • Fix · CNA Apache Thrift (Apache Software Foundation) Fixed in 0.24.0
  • Fix · CNA Apache Thrift (Apache Software Foundation) Fixed in 0.24.0

Red Hat 57 advisories

  • RHSA-2026:94503 Released 2026-11-03 · Red Hat rating Important
    RHEL AI 3.4 RPM runtime CVE fix - thrift
    • Red Hat Enterprise Linux AI 3.4 for RHEL 9 perl-thrift-1:0.15.0-8.el9ai, python3-thrift-1:0.15.0-8.el9ai, thrift-1:0.15.0-8.el9ai +3
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:76043 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.7 security update
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
Show 54 more Red Hat advisories
  • RHSA-2026:76041 Released 2026-10-05 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.7 security update
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:72880 Released 2026-09-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/submariner-addon-rhel9
  • RHSA-2026:71401 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (ROCm 7.14)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rocm-7.14-rhel9
  • RHSA-2026:71399 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (CUDA 12.9)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:71398 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (Spyre)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:71396 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (CUDA 13.0)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:71397 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (Rubin)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-rubin-rhel9
  • RHSA-2026:71395 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (Gaudi)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:71394 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (TPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:71393 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (CPU)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:71392 Released 2026-09-24 · Red Hat rating Important
    Red Hat AI Base Images 3.5.1 (Neuron)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:69935 Released 2026-09-22 · Red Hat rating Important
    Red Hat AI Base Images 3.4.2 (ROCm 6.4)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-6.4-rhel9
  • RHSA-2026:69934 Released 2026-09-22 · Red Hat rating Important
    Red Hat AI Base Images 3.4.2 (CUDA 13.0)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:69933 Released 2026-09-22 · Red Hat rating Important
    Red Hat AI Base Images 3.4.2 (CUDA 12.9)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:69932 Released 2026-09-22 · Red Hat rating Important
    Red Hat AI Base Images 3.4.2 (ROCm 7.1)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-rocm-7.1-rhel9
  • RHSA-2026:69931 Released 2026-09-22 · Red Hat rating Important
    Red Hat AI Base Images 3.4.2 (Spyre)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:69930 Released 2026-09-22 · Red Hat rating Important
    Red Hat AI Base Images 3.4.2 (Gaudi)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-gaudi-rhel9
  • RHSA-2026:69929 Released 2026-09-22 · Red Hat rating Important
    Red Hat AI Base Images 3.4.2 (CPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:69927 Released 2026-09-22 · Red Hat rating Important
    Red Hat AI Base Images 3.4.2 (TPU)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:68710 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Base Images 3.3.3 (CUDA)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cuda-12.9-rhel9
  • RHSA-2026:68709 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Base Images 3.3.3 (Spyre)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:68708 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Base Images 3.3.3 (CPU)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:68699 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.7 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:68698 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.7 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:68697 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.3.7 (Spyre)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-spyre-rhel9
  • RHSA-2026:68696 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.7 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:68639 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Base Images 3.3.3 (TPU)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:68638 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Base Images 3.3.3 (CUDA 13.0)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-cuda-13.0-rhel9
  • RHSA-2026:68637 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Base Images 3.3.3 (ROCm 7.0)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-rocm-7.0-rhel9
  • RHSA-2026:68640 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Base Images 3.3.3 (ROCm 6.4)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-rocm-6.4-rhel9
  • RHSA-2026:68634 Released 2026-09-17 · Red Hat rating Important
    Red Hat AI Base Images 3.3.3 (Neuron)
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:68333 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9 +5
  • RHSA-2026:67542 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +5
  • RHSA-2026:67541 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.7 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +9
  • RHSA-2026:67540 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.12 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +5
  • RHSA-2026:67539 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +7
  • RHSA-2026:67538 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.12 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/grafana-dashboard-loader-rhel9 +8
  • RHSA-2026:65542 Released 2026-09-08 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.11.0 release
    • Red Hat OpenShift distributed tracing 3.11 registry.redhat.io/rhosdt/opentelemetry-collector-rhel9
  • RHSA-2026:65343 Released 2026-09-08 · Red Hat rating Important
    Red Hat OpenShift distributed tracing platform (Tempo) 3.11.0 release
    • Red Hat OpenShift distributed tracing 3.11 registry.redhat.io/rhosdt/tempo-gateway-rhel9, registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9, registry.redhat.io/rhosdt/tempo-query-rhel9 +2
  • RHSA-2026:61629 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:61628 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:61627 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:60386 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31
  • RHSA-2026:59396 Released 2026-08-25 · Red Hat rating Important
    RHEL AI 3.3 RPM runtime CVE fix - thrift
    • Red Hat Enterprise Linux AI 3.3 for RHEL 9 perl-thrift-1:0.15.0-7.el9ai, python3-thrift-1:0.15.0-7.el9ai, thrift-1:0.15.0-7.el9ai +3
  • RHSA-2026:59395 Released 2026-08-25 · Red Hat rating Important
    RHEL AI 3.4 RPM runtime CVE fix - thrift
    • Red Hat Enterprise Linux AI 3.4 for RHEL 9 perl-thrift-1:0.15.0-7.el9ai, python3-thrift-1:0.15.0-7.el9ai, thrift-1:0.15.0-7.el9ai +3
  • RHSA-2026:55810 Released 2026-08-17 · Red Hat rating Critical
    Multicluster Global Hub 1.4.8 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator
  • RHSA-2026:54577 Released 2026-08-13 · Red Hat rating Critical
    Multicluster Global Hub 1.5.7 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator
  • RHSA-2026:54392 Released 2026-08-12 · Red Hat rating Critical
    Multicluster Global Hub 1.6.5 security update
    • Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator
  • RHSA-2026:53530 Released 2026-08-11 · Red Hat rating Critical
    Multicluster Global Hub 1.7.2 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
  • RHSA-2026:52946 Released 2026-08-10 · Red Hat rating Critical
    Multicluster Global Hub 1.8.1 security update
    • Multicluster Global Hub 1.8.2 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator
  • RHSA-2026:46989 Released 2026-07-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images tempo3.0-3.0.2-0.2.hum1@aarch64, tempo3.0-3.0.2-0.2.hum1@src, tempo3.0-3.0.2-0.2.hum1@x86_64
  • RHSA-2026:46987 Released 2026-07-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images tempo2.10-2.10.7-0.2.hum1@aarch64, tempo2.10-2.10.7-0.2.hum1@src, tempo2.10-2.10.7-0.2.hum1@x86_64
  • RHSA-2026:46974 Released 2026-07-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images jaeger-2.20.0-0.5.hum1@aarch64, jaeger-2.20.0-0.5.hum1@src, jaeger-2.20.0-0.5.hum1@x86_64

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache Thrift — lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9

    15 records Highest priority Priority MEDIUM 10 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-40373 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()Priority MEDIUM 50
    • TI-2026-42227 Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypassPriority MEDIUM 46
    • TI-2026-42014 Apache Thrift: Rust binary protocol non-strict path missing string size limitPriority MEDIUM 46
    Show all 15 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Confidential Compute AttestationAffectedNo fix planned: Will not fix
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Ceph Storage 5AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 6AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Update ServiceAffectedNo fix yet
Cryostat 4 on RHEL 9Fixed RHSA-2026:68333
Multicluster Global Hub 1.4.9Fixed RHSA-2026:55810
Multicluster Global Hub 1.5.8Fixed RHSA-2026:54577
Multicluster Global Hub 1.6.6Fixed RHSA-2026:54392
Multicluster Global Hub 1.7.4Fixed RHSA-2026:53530
Multicluster Global Hub 1.8.2Fixed RHSA-2026:52946
Red Hat AI Inference Server 3.2Fixed RHSA-2026:61627, RHSA-2026:61628, RHSA-2026:61629
Red Hat AI Inference Server 3.3Fixed RHSA-2026:68696, RHSA-2026:68697, RHSA-2026:68698, RHSA-2026:68699
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:67538
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:67540
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:67539
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:67541
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:67542, RHSA-2026:72880
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:60386
Red Hat Enterprise Linux AI 3.3Fixed RHSA-2026:76041, RHSA-2026:76043
Red Hat Enterprise Linux AI 3.3 for RHEL 9Fixed RHSA-2026:59396
Red Hat Enterprise Linux AI 3.4 for RHEL 9Fixed RHSA-2026:59395, RHSA-2026:94503
Red Hat Hardened ImagesFixed RHSA-2026:46974, RHSA-2026:46987, RHSA-2026:46989
Red Hat OpenShift AI 3.3Fixed RHSA-2026:68634, RHSA-2026:68637, RHSA-2026:68638, RHSA-2026:68639, RHSA-2026:68640, RHSA-2026:68708, RHSA-2026:68709, RHSA-2026:68710, RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:69927, RHSA-2026:69929, RHSA-2026:69930, RHSA-2026:69931, RHSA-2026:69932, RHSA-2026:69933, RHSA-2026:69934, RHSA-2026:69935, RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:71392, RHSA-2026:71393, RHSA-2026:71394, RHSA-2026:71395, RHSA-2026:71396, RHSA-2026:71397, RHSA-2026:71398, RHSA-2026:71399, RHSA-2026:71401
Red Hat OpenShift distributed tracing 3.11Fixed RHSA-2026:65343, RHSA-2026:65542
Not affected: 20 products
  • Cryostat 4 on RHEL 9
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.5.8
  • Multicluster Global Hub 1.6.6
  • Multicluster Global Hub 1.7.4
  • Multicluster Global Hub 1.8.2
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift distributed tracing 3.11
  • Red Hat OpenStack Platform 18.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55969
  2. 2026-10-03 Alias added: GHSA-x8jh-qfcv-fp29
  3. 2026-10-06 Fix available: RHSA-2026:76043 · Red Hat
  4. 2026-10-06 Fix available: RHSA-2026:76041 · Red Hat
  5. 2026-10-06 Fix available: Red Hat Enterprise Linux AI 3.3 · Red Hat
  6. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  7. 2026-10-09 Affected versions changed · Red Hat
  8. 2026-10-10 Fix available: Red Hat OpenShift distributed tracing 3.11.2 · Red Hat
  9. 2026-10-15 Fix available: Red Hat OpenShift distributed tracing 3.11 · Red Hat
  10. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  11. 2026-10-20 Affected versions changed · Red Hat
  12. 2026-10-24 Fix available: Red Hat OpenShift distributed tracing 3.11.3 · Red Hat
  13. 2026-10-26 Fix available: Red Hat OpenShift distributed tracing 3.11 · Red Hat
  14. 2026-10-31 Affected versions changed · Red Hat
  15. 2026-11-03 Fix available: RHSA-2026:94503 · Red Hat
  16. 2026-11-03 Fix available: Red Hat Enterprise Linux AI 3.4 for RHEL 9 · Red Hat
  17. 2026-11-06 Fix available: Multicluster Global Hub 1.7.4, Red Hat Enterprise Linux AI 3.3 for RHEL 9 · Red Hat
  18. 2026-11-06 Fix available: RHSA-2026:59395 · Red Hat
  19. 2026-11-06 Fix available: RHSA-2026:59396 · Red Hat

References

Advisory 3

  • TI-2026-40373 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() CVSS 4.0CRITICAL 9.3
  • TI-2016-04675 Command injection in Apache Thrift CVSS 3.0HIGH 8.8
  • TI-2026-42227 Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass CVSS 4.0HIGH 8.7
  • TI-2026-42014 Apache Thrift: Rust binary protocol non-strict path missing string size limit CVSS 4.0HIGH 8.7
  • TI-2026-40370 Apache Thrift: Node.js quadratic-time DoS in server receive transports CVSS 4.0HIGH 8.7
  • TI-2026-35942 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift… CVSS 4.0HIGH 8.7
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences