Executive brief
Apache Thrift, a framework for cross-language service development, contains a security flaw in its C++ library. The software fails to correctly verify that a security certificate matches the server it is connecting to, specifically when handling wildcard certificates. This could allow an attacker to intercept or eavesdrop on encrypted communications between services, potentially exposing sensitive data.
Technical details
A vulnerability exists in the Apache Thrift C++ bindings within the TSSLSocket matchName() function due to improper validation of certificates (CWE-297). The implementation fails to correctly adhere to RFC 6125 regarding wildcard matching, leading to a host mismatch vulnerability. A remote attacker could exploit this during a Man-in-the-Middle (MitM) attack to present a certificate that should be rejected, allowing for the interception of encrypted traffic. The issue is resolved in Apache Thrift version 0.24.0.
Affected products
- Apache Software Foundation Apache Thrift before 0.24.0
Timeline
- 2026-07-24: disclosed: Initial disclosure on oss-security mailing list
- 2026-07-27: advisory: NVD publication date