CVE-2026-43870: apache software foundation apache thrift Path Traversal
CVSS: 7.3v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-43870DEBIAN-CVE-2026-43870GHSA-526f-jxpj-jmg2BIT-thrift-2026-43870CGA-287p-5hxw-ppcmCGA-2cxx-9r2m-x7c5CGA-2x5h-p6mx-h7jpCGA-33fx-xxgf-7fg7CGA-37jf-9398-5wf6CGA-388f-3p7g-c42mCGA-3g68-7hpq-295mCGA-3hx7-gh3h-m4fgCGA-3q5m-g7gj-v4qqCGA-3x33-mrvq-gg3pCGA-43wj-f6x4-xcc3CGA-496v-f87g-9p3qCGA-49v6-rc6h-68vrCGA-49x4-pffj-xqjfCGA-4m98-78cc-f439CGA-4v2p-jpw2-fvhcCGA-4xv8-6c7q-hjc8CGA-55fp-66p2-gxqwCGA-6vxw-gf2g-v5hfCGA-72m4-j3jj-phwhCGA-7g97-8m29-5v9jCGA-82mq-c82w-px3mCGA-82wg-p9p8-278qCGA-84jf-2h2j-q793CGA-8984-4x7j-jvq5CGA-924h-jfw2-v5qqCGA-95f5-vgp9-3jv7CGA-9mjm-6vm7-j7jjCGA-c8mv-4qw8-cgp2CGA-cc97-jcvm-vjr5CGA-cq6h-467h-p2xfCGA-f3xj-5w4j-w726CGA-f46g-hx56-cf76CGA-f4jp-rj7r-89rhCGA-fjxf-f334-mm7qCGA-fpjm-3j33-2rp3CGA-fq7g-449x-9267CGA-fr2m-9fp6-r7gwCGA-fww6-vfmg-gw9cCGA-g3fh-xq34-8j95CGA-hv62-hgmw-7627CGA-hv6m-r3gc-m7r5CGA-jcvj-5grq-x68rCGA-jh69-g9xv-2xr2CGA-jrx6-4c7q-phhpCGA-mcxp-c699-cg2vCGA-mhvh-6x7v-x83cCGA-mmhr-93q9-qq5wCGA-mp92-w4xp-4px4CGA-p38v-842c-wqgxCGA-p545-v7p9-wj8pCGA-p62j-pgjg-gw57CGA-p92p-gwh2-vg4hCGA-ppj2-c4mq-8jh4CGA-q262-27x5-wgxfCGA-r4xx-qf8x-2qr9CGA-rgv6-j22r-jw65CGA-xcfj-f882-25c4CGA-xgcm-w6ff-44j9CGA-xvmh-vpvv-q8rxCGA-px84-2fvg-gj96CGA-q6rq-vwp4-7f53CGA-r939-972j-53fgCGA-v2hp-2q33-r2gwCGA-vcw3-h9m8-5rcpCGA-vf96-49xm-5fwrCGA-vg56-7h96-f43mCGA-vw2h-vqrc-p3jcCGA-w86q-95fq-g64mCGA-w9h7-mqfh-p5jjCGA-xw9g-jggf-xjj2CGA-xxcf-qg2g-mg9mCGA-89xj-c2m9-xh9pCGA-r553-q5vr-cxpjCGA-rp7f-2324-j9c8CGA-jh92-xwph-v9j5
Published 05-05-2026Last modified 06-05-2026
Vulnerability summary
CVE-2026-43870 is a high (CVSS 7.3) Path Traversal vulnerability in apache software foundation apache thrift. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.2% of scored vulnerabilities.
CVSS score
7.3/10
010
High · v3.1 (CVE.org)EPSS score
0.38%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 1Timeline
- 05-05-2026PublishedVulnerability first disclosed.
- 06-05-2026Last modifiedVulnerability information updated.
Description
Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 7.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · DebianEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · NpmEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · ChainguardEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- NVDNIST7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
0.00 pp
From 0.38% on 18-09-2026
18-09-202618-10-2026
EPSS score0.38%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
- CWE-346Origin Validation ErrorThe product does not properly verify that the source of data or communication is valid.
- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
Affected systems
Chainguard40 products
- commercial-gitlab-rails-ee-assets-19.1All versions (No fix recorded)
- commercial-gitlab-rails-ee-assets-19.2All versions (No fix recorded)
- commercial-gitlab-rails-ee-assets-19.3All versions (No fix recorded)
- commercial-gitlab-rails-ee-assets-19.4All versions (No fix recorded)
- commercial-gitlab-rails-ee-assets-fips-19.1All versions (No fix recorded)
Apache1 product
- thrift< 0.23.0
Apache software foundation1 product
- apache thrift< 0.23.0
Debian1 product
- thriftAll versions (No fix recorded) | < 0.23.0-3
Npm1 product
- thrift≤ 0.22.0
Ubuntu1 product
- thriftAll versions (No fix recorded)
6 vendors · 45 products
References
11 links
- github.com/apache/thriftPACKAGE