CVE-2026-41636

Aliases:GHSA-r67j-r569-jrwpBIT-thrift-2026-41636DEBIAN-CVE-2026-41636CGA-2695-37h2-hw3qCGA-2867-c6rp-x3fmCGA-288w-4q3j-72jgCGA-2c7p-f233-mpq6CGA-2v2m-282m-mmh7CGA-38qj-24ph-j6r2CGA-3grw-f467-6r28CGA-4jch-f4q8-rpwjCGA-54mj-qw4j-wf59CGA-59vh-q2mx-fvw4CGA-5r96-x835-vqp2CGA-636r-9w3x-x3fpCGA-637j-9h48-7wr7CGA-7666-5w6q-5fvxCGA-7rfm-23rr-hrpcCGA-7w4q-46p7-6v2pCGA-7x2m-wqcc-qf87CGA-83f6-cpj8-5pj5CGA-85cv-4gfx-c95gCGA-88jh-w6jm-f746CGA-958v-c45f-9x39CGA-95rg-4q26-hr5gCGA-9f5h-3g3r-g57rCGA-c6hf-r2v5-mh9rCGA-cv9v-vmc8-q3jpCGA-fjp2-c6q7-qqm6CGA-fqwp-m66q-7732CGA-fwmv-3wrw-x7w5CGA-fwv7-4ggf-hr35CGA-g26j-5945-3973CGA-g4fh-grhq-9gpwCGA-h4mq-h942-2vgmCGA-h5rh-72xm-rr7mCGA-hv73-pppr-3c5mCGA-j72q-2g2p-fcx8CGA-jvq8-3hwr-qwrrCGA-mq29-65jc-gg73CGA-mqhq-6v9f-25q8CGA-mqxm-4wx8-7hwqCGA-p3qp-cj9c-3qm7CGA-p44c-8xmx-pw4mCGA-pp6w-qc57-m3qrCGA-pwcx-2qgv-2w53CGA-px67-fp7q-mfwqCGA-q3vx-rf6m-hr37CGA-qvqf-rfq8-mpcjCGA-qwx2-9x8r-3xcfCGA-rh79-8j73-3rr7CGA-rxwq-q7px-m7vwCGA-v8x9-c2mf-xp98CGA-w3cf-vx7m-6pv9CGA-w9v3-2gh6-2c6fCGA-x92j-965m-7jjxCGA-xjhp-m23m-hv3cCGA-xr3c-9p83-qf96CGA-xv47-f389-x8g2CGA-27gv-p22h-67h8CGA-ff27-48v9-6vrmCGA-vg53-8838-39p2CGA-2xrx-crq4-h4q2CGA-8c5f-79rw-34xpCGA-26vq-qcwq-vwwvCGA-456r-79p4-m5vgCGA-9vx5-89rr-qvg4CGA-ww55-23hc-mcrgCGA-753c-63jg-w682CGA-mwpm-j2c3-732wCGA-mwvr-cxm5-884qCGA-px7m-x3rw-v8gj
Advisory lineage Upstream: 0 Downstream: 5
Analyzed
Published: 28 Apr 2026, 09:22
Last modified:28 Apr 2026, 12:15

Vulnerability Summary

Overall Risk (default)
medium
35/100
CVSS Score
8.7 HIGH
v4.0 (cve.org)
EPSS Score
0.45% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

28 Apr 2026, 09:22
Published
Vulnerability first disclosed
28 Apr 2026, 12:15
Last Modified
Vulnerability information updated

Description

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

CVSS Metrics

  • v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
  • v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.45%• Percentile: 39%

Techniques & Countermeasures

  • CWE-674•Uncontrolled Recursion

    The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected Systems

  • apache software foundation•apache thrift

    < 0.23.0

  • apache•thrift

    < 0.23.0

  • chainguard•commercial-gitlab-rails-ee-assets-19.1

    all

  • chainguard•commercial-gitlab-rails-ee-assets-19.2

    all

  • chainguard•commercial-gitlab-rails-ee-assets-19.3

    all

  • chainguard•commercial-gitlab-rails-ee-assets-fips-19.1

    all

  • chainguard•commercial-gitlab-rails-ee-assets-fips-19.2

    all

  • chainguard•commercial-gitlab-rails-ee-assets-fips-19.3

    all

  • chainguard•gitlab-rails-ce-assets-18.1

    < 0

  • chainguard•gitlab-rails-ce-assets-18.10

    < 0

  • chainguard•gitlab-rails-ce-assets-18.11

    < 0

  • chainguard•gitlab-rails-ce-assets-18.3

    all

  • chainguard•gitlab-rails-ce-assets-18.4

    all

  • chainguard•gitlab-rails-ce-assets-18.5

    all

  • chainguard•gitlab-rails-ce-assets-18.6

    all

  • chainguard•gitlab-rails-ce-assets-18.7

    all

  • chainguard•gitlab-rails-ce-assets-18.8

    all

  • chainguard•gitlab-rails-ce-assets-18.9

    < 18.9.6-r2

  • chainguard•gitlab-rails-ce-assets-19.0

    < 0

  • chainguard•gitlab-rails-ce-assets-19.1

    < 0

  • chainguard•gitlab-rails-ce-assets-19.2

    < 0

  • chainguard•gitlab-rails-ce-assets-19.3

    < 0

  • chainguard•gitlab-rails-ce-assets-19.4

    all

  • chainguard•gitlab-rails-ce-assets-fips-18.1

    all

  • chainguard•gitlab-rails-ce-assets-fips-18.10

    < 0

  • chainguard•gitlab-rails-ce-assets-fips-18.11

    < 0

  • chainguard•gitlab-rails-ce-assets-fips-18.3

    all

  • chainguard•gitlab-rails-ce-assets-fips-18.4

    all

  • chainguard•gitlab-rails-ce-assets-fips-18.5

    all

  • chainguard•gitlab-rails-ce-assets-fips-18.6

    all

  • chainguard•gitlab-rails-ce-assets-fips-18.7

    all

  • chainguard•gitlab-rails-ce-assets-fips-18.8

    all

  • chainguard•gitlab-rails-ce-assets-fips-18.9

    all

  • chainguard•gitlab-rails-ce-assets-fips-19.0

    < 0

  • chainguard•gitlab-rails-ce-assets-fips-19.1

    < 0

  • chainguard•gitlab-rails-ce-assets-fips-19.2

    < 0

  • chainguard•gitlab-rails-ce-assets-fips-19.3

    < 0

  • chainguard•gitlab-rails-ce-assets-fips-19.4

    all

  • debian•thrift

    all | all | all | < 0.23.0-3

  • Npm•thrift

    < 0.23.0

References (6)