{"id":"CVE-2026-41603","kind":"vulnerability","aliases":["CVE-2026-41603","GHSA-gf47-qgg5-9g9q"],"related":[],"title":"Apache Thrift has an issue with Java TSSLTransportFactory hostname verification","description":"Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","summary":"The Java TSSLTransportFactory in Apache Thrift does not properly verify that a server certificate matches the host being connected to. An attacker positioned on the network path can present any valid-looking certificate and intercept the Thrift traffic.","severity":"high","cvss":7.4,"epss":0.00571,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.thrift:libthrift","fixed":["0.23.0"],"affected":"< 0.23.0","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["apache-thrift","cwe-295","cwe-297","java","maven","package","tls"],"not_affected_if":["libthrift-0.23.0-or-later","non-java-thrift","plaintext-transport"],"how_to_check":"- Run `mvn dependency:tree | grep libthrift` in the project and look for a version below `0.23.0`\n- Check for `org.apache.thrift:libthrift` in `build.gradle` or `pom.xml` and confirm the pinned version","fix":"- Upgrade `org.apache.thrift:libthrift` to `0.23.0` or later\n- Rebuild and redeploy services that link against libthrift","status":"withdrawn","published_at":"2026-04-28T10:16:03+00:00","first_seen_at":"2026-10-28T19:51:20+00:00","triaged_at":"2026-10-28T19:52:20+00:00","updated_at":"2026-10-28T20:05:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T19:52:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `org.apache.thrift:libthrift` to `0.23.0` or later\n- Rebuild and redeploy services that link against libthrift","reach":"network","title":"Apache Thrift Java: TLS client skips hostname check, enabling man-in-the-middle","impact":"medium","summary":"The Java TSSLTransportFactory in Apache Thrift does not properly verify that a server certificate matches the host being connected to. An attacker positioned on the network path can present any valid-looking certificate and intercept the Thrift traffic.","category":"package","nicknames":[],"who_cares":["java","maven","apache-thrift","tls"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker intercepts and reads or alters Thrift traffic between client and server","analyst_note":"","how_to_check":"- Run `mvn dependency:tree | grep libthrift` in the project and look for a version below `0.23.0`\n- Check for `org.apache.thrift:libthrift` in `build.gradle` or `pom.xml` and confirm the pinned version","needs_analyst":false,"not_affected_if":["non-java-thrift","plaintext-transport","libthrift-0.23.0-or-later"],"who_is_affected":"Java applications that use libthrift's TSSLTransportFactory to open TLS connections to Thrift services are exposed, since the client accepts certificates for the wrong host. Systems that only run Thrift over plaintext, or that use other languages' Thrift libraries, are not affected by this Java flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00062,"input_tokens":3364,"output_tokens":568,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,20A '-295':28B '-297':30B '-41603':13A,21A '0.23.0':91C,99C '9g9q':18A 'affect':87C 'apach':1A,25B,39B,83C,88C 'apache-thrift':24B 'attack':56B 'certif':48B,68B,77C 'connect':53B 'cve':11A,19A 'cwe':27B,29B 'fix':101C 'gf47':16A 'ghsa':15A 'ghsa-gf47-qgg5-9g9q':14A 'host':51B,79C 'hostnam':9A 'improp':74C 'intercept':70B 'issu':5A,86C,103C 'java':7A,31B,36B 'libthrift':23A 'look':67B 'match':49B 'maven':32B 'mismatch':80C 'network':60B 'org.apache.thrift':22A 'packag':33B 'path':61B 'posit':57B 'present':63B 'proper':43B 'qgg5':17A 'recommend':94C 'server':47B 'thrift':2A,26B,40B,72B,84C,89C 'tls':34B 'traffic':73B 'tssltransportfactori':8A,37B 'upgrad':96C 'user':92C 'valid':66B,75C 'valid-look':65B 'verif':10A 'verifi':44B 'version':98C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Java applications that use libthrift's TSSLTransportFactory to open TLS connections to Thrift services are exposed, since the client accepts certificates for the wrong host. Systems that only run Thrift over plaintext, or that use other languages' Thrift libraries, are not affected by this Java flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-28T10:16:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-gf47-qgg5-9g9q","url":"https://github.com/advisories/GHSA-gf47-qgg5-9g9q","severity":"high","published_at":"2026-04-28T12:31:30+00:00","modified_at":"2026-10-28T19:51:11+00:00","first_seen_at":"2026-10-28T19:51:20+00:00","fetched_at":"2026-10-28T19:56:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-41603","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41603","severity":null,"published_at":"2026-04-28T10:16:03+00:00","modified_at":"2026-07-27T15:16:49+00:00","first_seen_at":"2026-10-28T20:05:07+00:00","fetched_at":"2026-10-28T20:05:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}