CVE-2026-41602

EUVD-2026-26020
Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 22%
Affected Products (NVD)
VendorProductVersion
apachethrift
𝑥
< 0.23.0
𝑥
= Vulnerable software versions
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
golang-github-prometheus-node_exporter
suse enterprise server 15 SP4
1.10.2-150100.3.41.2
fixed
suse enterprise server 15 SP5
1.10.2-150100.3.41.2
fixed
suse enterprise server 15 SP6
1.10.2-150100.3.41.2
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
amazon-cloudwatch-agent
Amazon Linux 2
0:1.300066.2-2.amzn2
fixed
Amazon Linux 2023
0:1.300066.2-2.amzn2023
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
influxdb
Azure Linux 3.0
0:2.7.5-16.azl3
fixed
kata-containers
Azure Linux 3.0
0:3.19.1.kata3-2.azl3
fixed
kata-containers-cc
Azure Linux 3.0
0:3.15.0.aks0-10.azl3
fixed
telegraf
Azure Linux 3.0
0:1.31.0-20.azl3
fixed
thrift
Azure Linux 3.0
0:0.15.0-6.azl3
fixed
Common Weakness Enumeration
References
https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql
http://www.openwall.com/lists/oss-security/2026/04/28/6