Is CVE-2026-41606 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41606 being exploited in the wild.

How severe is CVE-2026-41606?

Medium severity, with a CVSS score of 5.3, published 28 April 2026.

Which products and versions are affected?

Red Hat Multicluster Global Hub 1.3.4, 1.4.5, 1.5.4, 1.6.2; Red Hat OpenShift distributed tracing platform (Tempo) 3.9.3.

Is there a fix for CVE-2026-41606?

A patch was published on 2026-05-07: Red Hat released security advisory RHSA-2026:14885 for OpenShift distributed tracing Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41606 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41606?

Check whether you run Apache Thrift, Red Hat Multicluster Global Hub or Red Hat OpenShift distributed tracing platform (Tempo) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41606: Apache Thrift uncontrolled recursion in c_glib dispatch

CVE-2026-41606 · Severity: medium · CVSS 5.3 · Published 2026-04-28

Apache Thrift, a framework used for scalable cross-language services development, is vulnerable to a flaw that can crash applications. By sending specially crafted input, a remote attacker can cause the software to enter an infinite loop or exhaust its memory. This results in a denial-of-service (DoS) condition, making the affected service or application unavailable to legitimate users.

Technologies: Apache Thrift, Red Hat Multicluster Global Hub. Vendors: Apache, Red Hat.

Quick answers

Is CVE-2026-41606 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41606 being exploited in the wild.
How severe is CVE-2026-41606?: Medium severity, with a CVSS score of 5.3, published 28 April 2026.
Which products and versions are affected?: Red Hat Multicluster Global Hub 1.3.4, 1.4.5, 1.5.4, 1.6.2; Red Hat OpenShift distributed tracing platform (Tempo) 3.9.3.
Is there a fix for CVE-2026-41606?: A patch was published on 2026-05-07: Red Hat released security advisory RHSA-2026:14885 for OpenShift distributed tracing Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41606 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41606?: Check whether you run Apache Thrift, Red Hat Multicluster Global Hub or Red Hat OpenShift distributed tracing platform (Tempo) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An uncontrolled recursion vulnerability exists in Apache Thrift's c_glib implementation before version 0.23.0. The flaw is triggered during the dispatch process when the library handles specially crafted input, leading to a stack overflow or excessive resource consumption. A remote, unauthenticated attacker can exploit this over a network to cause a denial-of-service (DoS) by crashing the service or making it unresponsive. Red Hat has also identified this as affecting several of its products that bundle Thrift, such as OpenShift distributed tracing and Multicluster Global Hub. Users are advised to upgrade to Apache Thrift 0.23.0 or apply vendor-specific patches.

Affected products

Apache Thrift before 0.23.0
Red Hat Multicluster Global Hub 1.3.4, 1.4.5, 1.5.4, 1.6.2
Red Hat Advanced Cluster Management for Kubernetes 2.15
Red Hat OpenShift distributed tracing platform (Tempo) 3.9.3

Timeline

2026-04-28: disclosed: Initial disclosure by Apache Software Foundation and Openwall mailing list
2026-04-28: advisory
2026-05-07: patched: Red Hat released security advisory RHSA-2026:14885 for OpenShift distributed tracing

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.