# CVE-2026-41607: Apache Thrift out-of-bounds read in C++ JSON implementation

Source: https://junglewise.ai/threats/cve-2026-41607-apache-thrift-out-of-bounds-read-in-c-json-implementation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-28. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-41607 · Severity: medium · CVSS 6.5 · Published 2026-04-28

Apache Thrift, a framework for scalable cross-language services development, is vulnerable to a memory handling flaw. An attacker can exploit this to read sensitive information from the system's memory or cause the service to crash, leading to a denial of service. This affects various enterprise products that integrate Thrift, including Red Hat OpenShift and Advanced Cluster Management.

Technologies: [Apache Thrift](https://junglewise.ai/threats/technologies/thrift), [Red Hat Multicluster Global Hub](https://junglewise.ai/threats/technologies/multicluster-global-hub). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-41607 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41607 being exploited in the wild.

**How severe is CVE-2026-41607?** Medium severity, with a CVSS score of 6.5, published 28 April 2026.

**Which products and versions are affected?** Red Hat Multicluster Global Hub 1.3.4, 1.4.5, 1.5.4, 1.6.2.

**Is there a fix for CVE-2026-41607?** A patch was published on 2026-05-07: Red Hat released security advisory RHSA-2026:14885 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41607 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41607?** Check whether you run Apache Thrift or Red Hat Multicluster Global Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds (OOB) read vulnerability exists in Apache Thrift's C++ JSON protocol implementation. The flaw occurs when the library processes specially crafted input, failing to properly validate memory access boundaries. A remote, unauthenticated attacker can exploit this via the network to access memory outside of allocated buffers. This can result in the disclosure of sensitive information or trigger a crash (Denial of Service). The issue is resolved in Apache Thrift version 0.23.0. Red Hat has also issued several security advisories (e.g., RHSA-2026:14885) for downstream products incorporating the vulnerable library.

## Affected products

- Apache Thrift before 0.23.0
- Red Hat Multicluster Global Hub 1.3.4, 1.4.5, 1.5.4, 1.6.2
- Red Hat Advanced Cluster Management for Kubernetes 2.15
- Red Hat OpenShift distributed tracing 3.9.3
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift Container Platform 4

## Timeline

- 2026-04-27: disclosed: Initial disclosure on oss-security mailing list
- 2026-04-28: advisory: NVD publication date
- 2026-05-07: patched: Red Hat released security advisory RHSA-2026:14885

## References

- [https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql](https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql)
- [http://www.openwall.com/lists/oss-security/2026/04/28/2](http://www.openwall.com/lists/oss-security/2026/04/28/2)
- [https://access.redhat.com/errata/RHSA-2026:14885](https://access.redhat.com/errata/RHSA-2026:14885)
- [https://access.redhat.com/errata/RHSA-2026:21769](https://access.redhat.com/errata/RHSA-2026:21769)
- [https://access.redhat.com/errata/RHSA-2026:22347](https://access.redhat.com/errata/RHSA-2026:22347)
- [https://access.redhat.com/errata/RHSA-2026:22423](https://access.redhat.com/errata/RHSA-2026:22423)
- [https://access.redhat.com/errata/RHSA-2026:23345](https://access.redhat.com/errata/RHSA-2026:23345)

## Related threats

- [Apache Thrift uncontrolled recursion in Java bindings](https://junglewise.ai/threats/cve-2026-120135-uncontrolled-recursion-vulnerability-in-apache-thrift-java)
- [Apache Thrift uncontrolled recursion in PHP bindings](https://junglewise.ai/threats/cve-2026-96289-uncontrolled-recursion-vulnerability-in-apache-thrift-php)
- [Apache Thrift Perl bindings inefficient algorithmic complexity](https://junglewise.ai/threats/cve-2026-96287-inefficient-algorithmic-complexity-vulnerability-in-apache-thrift)
- [Apache Thrift uncaught exception in Perl bindings](https://junglewise.ai/threats/cve-2026-96286-uncaught-exception-vulnerability-in-apache-thrift-perl-bindings)
- [Apache Thrift Ruby bindings exception handling vulnerability](https://junglewise.ai/threats/cve-2026-96277-uncaught-exception-improper-handling-of-exceptional-conditions)