CVE-2026-43869: apache software foundation apache thrift
CVSS: 7.3v3.1HighModified
AliasesUBUNTU-CVE-2026-43869DEBIAN-CVE-2026-43869CGA-5779-c3h4-pjffCGA-6mc6-3mg4-px8gCGA-777h-3j82-xfr7CGA-9xxh-cjf7-4j6jCGA-ccc8-wgfv-wqr3CGA-gpr2-fw72-g3wwCGA-gwhm-4278-7hg5CGA-j9mq-24vj-6j33CGA-qhwg-jc3c-ggxhCGA-v7q4-f9q5-964qCGA-wfrr-hvmw-q6f8CGA-x4p6-85mg-2cwgCGA-xgjw-8cvc-m4g9CGA-xwfc-2fq3-cgh5CGA-222x-qr79-hxj7CGA-2gv8-p585-29fqCGA-3ph3-7phf-vhxjCGA-44hc-3h6p-j85mCGA-4mh3-45xc-mj6xCGA-5hw5-g9gf-5g2rCGA-69f7-4qq9-fmv2CGA-8v53-hjr8-47vhCGA-8xg9-v88q-3xfhCGA-9qrp-cg62-9gpcCGA-f49v-2wvf-3q2rCGA-fr44-cfxx-5m9cCGA-gr9g-f2r4-3p3gCGA-hcg9-9hfp-p8q5CGA-hcw8-m977-pc84CGA-hf6c-wcw6-7wqcCGA-hrhh-8g5v-5926CGA-hvc9-v7w3-mxvxCGA-jhmh-rxwp-7489CGA-jwwm-qcrq-67fpCGA-p96r-xr63-3f96GHSA-7pwc-h2j2-rjgjBIT-thrift-2026-43869CGA-q5cq-9vwm-v9xjCGA-qh8f-945f-qcfmCGA-qmqx-46gr-35jqCGA-r4x3-rpmq-r49jCGA-rq2p-pg24-xm9qCGA-vcfp-h3vj-r989CGA-w332-f37h-5pjcCGA-w829-c8c5-qmrgCGA-x52r-hj6p-m686CGA-xcx3-mq55-639pCGA-xpq3-385j-vjx2
Published 05-05-2026Last modified 09-09-2026
Vulnerability summary
CVE-2026-43869 is a high (CVSS 7.3) vulnerability in apache software foundation apache thrift. EPSS estimates a 0.81% chance of exploitation in the next 30 days, higher than 56% of scored vulnerabilities.
CVSS score
7.3/10
010
High · v3.1 (CVE.org)EPSS score
0.81%
0%100%
Low · +0.18 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 05-05-2026PublishedVulnerability first disclosed.
- 09-09-2026Last modifiedVulnerability information updated.
Description
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · DebianEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · WolfiEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · ChainguardEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · MavenEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- NVDNIST7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS trend
Probability
0.81%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
+0.18 pp
From 0.63% on 18-09-2026
18-09-202618-10-2026
EPSS score0.81%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-297Improper Validation of Certificate with Host MismatchThe product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
- CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.
Affected systems
Chainguard19 products
- automq< 1.7.4-r1 | All versions (No fix recorded)
- automq-fipsAll versions (No fix recorded) | < 1.7.4-r1
- druidAll versions (No fix recorded)
- kserve-modelmeshAll versions (No fix recorded)
- nuxeo-2023< 2023.45-r13
Wolfi6 products
- druidAll versions (No fix recorded)
- kserve-modelmeshAll versions (No fix recorded)
- spark-4.0-scala-2.13< 4.0.2-r11
- spark-4.1-scala-2.13All versions (No fix recorded)
- wavefront-proxy< 13.9-r27
Apache1 product
- thrift< 0.23.0
Apache software foundation1 product
- apache thrift< 0.23.0
Debian1 product
- thriftAll versions (No fix recorded) | < 0.23.0-3
Org.apache.thrift1 product
- libthrift< 0.23.0
Ubuntu1 product
- thriftAll versions (No fix recorded)
7 vendors · 30 products
References
27 linksShow all 27 references
- github.com/apache/thriftPACKAGE