Live › vulnerability › CVE-2026-41603
Go to dashboardThe Java TSSLTransportFactory in Apache Thrift does not properly verify that a server certificate matches the host being connected to. An attacker positioned on the network path can present any valid-looking certificate and intercept the Thrift traffic.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:51 UTC, 0h before NVD. All times on this page are UTC.
Java applications that use libthrift's TSSLTransportFactory to open TLS connections to Thrift services are exposed, since the client accepts certificates for the wrong host. Systems that only run Thrift over plaintext, or that use other languages' Thrift libraries, are not affected by this Java flaw.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.apache.thrift:libthrift | maven | < 0.23.0 | 0.23.0 |
mvn dependency:tree | grep libthrift in the project and look for a version below 0.23.0org.apache.thrift:libthrift in build.gradle or pom.xml and confirm the pinned versionorg.apache.thrift:libthrift to 0.23.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-41603")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.