Junglewise Threat Intelligence

CVE-2026-41602: Apache Thrift integer overflow in Go TFramedTransport

CVE-2026-41602 · Severity: high · CVSS 7.5 · Published 2026-04-28

Technologies: Apache Thrift, Red Hat AI Inference Server, Red Hat Multicluster Global Hub. Vendors: Red Hat, Apache, Go.

Executive brief

Apache Thrift is a widely used framework for scalable cross-language services development. A vulnerability in its Go language implementation could allow a remote attacker to cause a denial-of-service condition. This would result in the affected service becoming unresponsive, potentially disrupting business operations and data processing tasks that rely on Thrift-based communication.

Technical details

An integer overflow or wraparound vulnerability exists in the TFramedTransport component of the Apache Thrift Go language implementation. The flaw occurs when processing specially crafted framed transport data, where a uint32 overflow can be triggered. A remote, unauthenticated attacker can exploit this over a network to cause unexpected behavior or resource exhaustion, leading to a denial of service (DoS). The issue is addressed in Apache Thrift version 0.23.0. Red Hat has also issued several advisories for downstream products like OpenShift and Ceph Storage that incorporate the vulnerable library.

Affected products

  • Apache Thrift before 0.23.0
  • Red Hat Multicluster Global Hub 1.3.4, 1.4.5, 1.5.4, 1.6.2, 1.7.1
  • Red Hat Advanced Cluster Management for Kubernetes 2.15, 2.16
  • Red Hat OpenShift distributed tracing 3.9.3
  • Red Hat AI Inference Server 3
  • Red Hat Ceph Storage 5, 6, 9

Timeline

  • 2026-04-28: disclosed: Initial disclosure by Apache Software Foundation
  • 2026-04-28: advisory
  • 2026-04-28: patched: Fixed in Apache Thrift 0.23.0

References

Related threats