Junglewise Threat Intelligence

CVE-2026-41606: Apache Thrift uncontrolled recursion in c_glib dispatch

CVE-2026-41606 · Severity: medium · CVSS 5.3 · Published 2026-04-28

Technologies: Apache Thrift, Red Hat Multicluster Global Hub. Vendors: Red Hat, Apache.

Executive brief

Apache Thrift, a framework used for scalable cross-language services development, is vulnerable to a flaw that can crash applications. By sending specially crafted input, a remote attacker can cause the software to enter an infinite loop or exhaust its memory. This results in a denial-of-service (DoS) condition, making the affected service or application unavailable to legitimate users.

Technical details

An uncontrolled recursion vulnerability exists in Apache Thrift's c_glib implementation before version 0.23.0. The flaw is triggered during the dispatch process when the library handles specially crafted input, leading to a stack overflow or excessive resource consumption. A remote, unauthenticated attacker can exploit this over a network to cause a denial-of-service (DoS) by crashing the service or making it unresponsive. Red Hat has also identified this as affecting several of its products that bundle Thrift, such as OpenShift distributed tracing and Multicluster Global Hub. Users are advised to upgrade to Apache Thrift 0.23.0 or apply vendor-specific patches.

Affected products

  • Apache Thrift before 0.23.0
  • Red Hat Multicluster Global Hub 1.3.4, 1.4.5, 1.5.4, 1.6.2
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat OpenShift distributed tracing platform (Tempo) 3.9.3

Timeline

  • 2026-04-28: disclosed: Initial disclosure by Apache Software Foundation and Openwall mailing list
  • 2026-04-28: advisory
  • 2026-05-07: patched: Red Hat released security advisory RHSA-2026:14885 for OpenShift distributed tracing

References

Related threats