IBM App Connect Enterprise (Apache Thrift): Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 8.7
  CVE-2026-41636

  Apache Thrift: Node.js skip() recursion

  Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

  Apache Software Foundation Apache Thrift thrift thrift Debian Ubuntu Azure Linux Alpine npm
  Apr 28, 2026
• High 7.3
  CVE-2026-43870

  Apache Thrift: Node.js web_server.js multi-vulnerability

  Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache T…

  Apache Software Foundation Apache Thrift thrift thrift Debian Ubuntu npm
  May 5, 2026

Revision history

1. 2026-08-11 #2

   Neue Updates von Red Hat aufgenommen

2. 2026-06-24 #1

   Initiale Fassung

References

• IBM Security Bulletin 7277920 vom 2026-06-24
  https://www.ibm.com/support/pages/node/7277920
• Red Hat Security Advisory RHSA-2026:53530 vom 2026-08-11
  https://access.redhat.com/errata/RHSA-2026:53530