Red Hat Security Advisory: RHEL AI 3.3 RPM runtime CVE fix - thrift

Fixed packages 12

Vulnerabilities 7

• Critical 9.3
  CVE-2026-55971

  Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()

  Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

  Apache Software Foundation Apache Thrift thrift thrift Debian Ubuntu Azure Linux
  Jul 27, 2026
• High 8.7
  CVE-2026-48586

  Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit

  Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the iss…

  Apache Software Foundation Apache Thrift telegraf thrift Debian Ubuntu Azure Linux
  Jul 27, 2026
• High 8.7
  CVE-2026-55969

  Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()

  Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

  Apache Software Foundation Apache Thrift telegraf thrift Debian Ubuntu Azure Linux
  Jul 27, 2026
• High 8.7
  CVE-2026-58662

  Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass

  Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

  Apache Software Foundation Apache Thrift thrift thrift Debian Ubuntu Azure Linux
  Jul 27, 2026
• High 8.2
  CVE-2026-48145

  Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass

  Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

  Apache Software Foundation Apache Thrift thrift thrift Debian Ubuntu Azure Linux
  Jul 27, 2026
• Medium 6.9
  CVE-2026-55970

  Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()

  Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

  Apache Software Foundation Apache Thrift thrift thrift Debian Ubuntu Azure Linux
  Jul 27, 2026
• Medium 6.5
  CVE-2026-41607

  Apache Thrift: C++ JSON OOB read

  Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

  Apache Software Foundation Apache Thrift thrift thrift Debian Ubuntu Azure Linux Alpine
  Apr 28, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://issues.redhat.com/browse/AIPCC-29844
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59396.json
• report
  https://access.redhat.com/security/cve/CVE-2026-41607
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2463412
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-41607
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-41607
• article
  http://www.openwall.com/lists/oss-security/2026/04/28/2
• article
  https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql
• report
  https://access.redhat.com/security/cve/CVE-2026-48145
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507431
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-48145
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-48145
• article
  http://www.openwall.com/lists/oss-security/2026/07/24/36
• article
  https://lists.apache.org/thread/2popgc4ks1l87jjho1w5fpk5k4x06b7h
• article
  https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9
• report
  https://access.redhat.com/security/cve/CVE-2026-48586
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507434
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-48586
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-48586
• article
  http://www.openwall.com/lists/oss-security/2026/07/24/37
• article
  https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq
• report
  https://access.redhat.com/security/cve/CVE-2026-55969
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507433
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55969
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55969
• article
  http://www.openwall.com/lists/oss-security/2026/07/24/40
• article
  https://lists.apache.org/thread/xmkgd107k795hyrg5kf97mny30sgl5bo
• report
  https://access.redhat.com/security/cve/CVE-2026-55970
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507438
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55970
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55970
• article
  https://lists.apache.org/thread/8pbnw4dyxxc9opp6qq725jhrzg25v8q7
• report
  https://access.redhat.com/security/cve/CVE-2026-55971
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2507448
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55971
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55971
• article
  https://lists.apache.org/thread/xjs36m6kjxpmrmzwck636msg3nvoqnmx
• report
  https://access.redhat.com/security/cve/CVE-2026-58662