CVE-2026-41602

EUVD-2026-26020
Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 63%
Affected Products (NVD)
VendorProductVersion
apachethrift
𝑥
< 0.23.0
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatMulticluster Global Hub 1.3.4
1779212259 ≤
𝑥
< *
ADP
Red HatMulticluster Global Hub 1.4.5
1779579439 ≤
𝑥
< *
ADP
Red HatMulticluster Global Hub 1.5.6
1778867753 ≤
𝑥
< *
ADP
Red HatMulticluster Global Hub 1.6.2
1780167118 ≤
𝑥
< *
ADP
Red HatMulticluster Global Hub 1.7.0
1779925273 ≤
𝑥
< *
ADP
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.14
1782693386 ≤
𝑥
< *
ADP
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.15
1780677003 ≤
𝑥
< *
ADP
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.16
1780926805 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift distributed tracing 3.9.1
1778056267 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift distributed tracing 3.9.1
1778158391 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift distributed tracing 3.9.1
1778158343 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift distributed tracing 3.9.1
1778158374 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
thrift
bookworm
no-dsa
bullseye
postponed
forky
0.23.0-3
fixed
sid
0.23.0-3
fixed
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
thrift
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
alloy
suse enterprise desktop 15 SP7
1.16.1-150700.15.20.1
fixed
suse enterprise sap 15 SP7
1.16.1-150700.15.20.1
fixed
suse enterprise server 15 SP7
1.16.1-150700.15.20.1
fixed
golang-github-prometheus-node_exporter
suse enterprise desktop 15 SP7
1.10.2-150100.3.41.2
fixed
suse enterprise sap 15 SP7
1.10.2-150100.3.41.2
fixed
suse enterprise server 15 SP4
1.10.2-150100.3.41.2
fixed
suse enterprise server 15 SP5
1.10.2-150100.3.41.2
fixed
suse enterprise server 15 SP6
1.10.2-150100.3.41.2
fixed
suse enterprise server 15 SP7
1.10.2-150100.3.41.2
fixed
terraform-provider-aws
suse enterprise sap 15 SP4
3.11.0-150200.6.18.1
fixed
suse enterprise sap 15 SP5
3.11.0-150200.6.18.1
fixed
suse enterprise server 15 SP4
3.11.0-150200.6.18.1
fixed
suse enterprise server 15 SP5
3.11.0-150200.6.18.1
fixed
terraform-provider-azurerm
suse enterprise sap 15 SP4
2.32.0-150200.6.12.1
fixed
suse enterprise sap 15 SP5
2.32.0-150200.6.12.1
fixed
suse enterprise server 15 SP4
2.32.0-150200.6.12.1
fixed
suse enterprise server 15 SP5
2.32.0-150200.6.12.1
fixed
terraform-provider-external
suse enterprise sap 15 SP4
2.0.0-150200.6.12.1
fixed
suse enterprise sap 15 SP5
2.0.0-150200.6.12.1
fixed
suse enterprise server 15 SP4
2.0.0-150200.6.12.1
fixed
suse enterprise server 15 SP5
2.0.0-150200.6.12.1
fixed
terraform-provider-google
suse enterprise sap 15 SP4
3.43.0-150200.6.12.1
fixed
suse enterprise sap 15 SP5
3.43.0-150200.6.12.1
fixed
suse enterprise server 15 SP4
3.43.0-150200.6.12.1
fixed
suse enterprise server 15 SP5
3.43.0-150200.6.12.1
fixed
terraform-provider-helm
suse enterprise sap 15 SP4
2.9.0-150200.6.23.1
fixed
suse enterprise sap 15 SP5
2.9.0-150200.6.23.1
fixed
suse enterprise server 15 SP4
2.9.0-150200.6.23.1
fixed
suse enterprise server 15 SP5
2.9.0-150200.6.23.1
fixed
terraform-provider-kubernetes
suse enterprise sap 15 SP4
1.13.2-150200.6.12.1
fixed
suse enterprise sap 15 SP5
1.13.2-150200.6.12.1
fixed
suse enterprise server 15 SP4
1.13.2-150200.6.12.1
fixed
suse enterprise server 15 SP5
1.13.2-150200.6.12.1
fixed
terraform-provider-local
suse enterprise sap 15 SP4
2.0.0-150200.6.17.1
fixed
suse enterprise sap 15 SP5
2.0.0-150200.6.17.1
fixed
suse enterprise server 15 SP4
2.0.0-150200.6.17.1
fixed
suse enterprise server 15 SP5
2.0.0-150200.6.17.1
fixed
terraform-provider-null
suse enterprise sap 15 SP4
3.0.0-150200.6.18.1
fixed
suse enterprise sap 15 SP5
3.0.0-150200.6.18.1
fixed
suse enterprise server 15 SP4
3.0.0-150200.6.18.1
fixed
suse enterprise server 15 SP5
3.0.0-150200.6.18.1
fixed
terraform-provider-random
suse enterprise sap 15 SP4
3.0.0-150200.6.15.1
fixed
suse enterprise sap 15 SP5
3.0.0-150200.6.15.1
fixed
suse enterprise server 15 SP4
3.0.0-150200.6.15.1
fixed
suse enterprise server 15 SP5
3.0.0-150200.6.15.1
fixed
terraform-provider-susepubliccloud
suse enterprise sap 15 SP4
0.0.1-150100.3.14.1
fixed
suse enterprise sap 15 SP5
0.0.1-150100.3.14.1
fixed
suse enterprise server 15 SP4
0.0.1-150100.3.14.1
fixed
suse enterprise server 15 SP5
0.0.1-150100.3.14.1
fixed
terraform-provider-tls
suse enterprise sap 15 SP4
3.0.0-150200.5.15.1
fixed
suse enterprise sap 15 SP5
3.0.0-150200.5.15.1
fixed
suse enterprise server 15 SP4
3.0.0-150200.5.15.1
fixed
suse enterprise server 15 SP5
3.0.0-150200.5.15.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
amazon-cloudwatch-agent
Amazon Linux 2
0:1.300066.2-2.amzn2
fixed
Amazon Linux 2023
0:1.300066.2-2.amzn2023
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
influxdb
Azure Linux 3.0
0:2.7.5-16.azl3
fixed
kata-containers
Azure Linux 3.0
0:3.19.1.kata3-2.azl3
fixed
kata-containers-cc
Azure Linux 3.0
0:3.15.0.aks0-10.azl3
fixed
telegraf
Azure Linux 3.0
0:1.31.0-20.azl3
fixed
thrift
Azure Linux 3.0
0:0.15.0-6.azl3
fixed
Common Weakness Enumeration
References
https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql
http://www.openwall.com/lists/oss-security/2026/04/28/6
https://access.redhat.com/errata/RHSA-2026:14162
https://access.redhat.com/errata/RHSA-2026:14885
https://access.redhat.com/errata/RHSA-2026:21769
https://access.redhat.com/errata/RHSA-2026:22347
https://access.redhat.com/errata/RHSA-2026:22423
https://access.redhat.com/errata/RHSA-2026:23345
https://access.redhat.com/errata/RHSA-2026:24503
https://access.redhat.com/errata/RHSA-2026:24539
https://access.redhat.com/errata/RHSA-2026:25273
https://access.redhat.com/errata/RHSA-2026:36882
https://access.redhat.com/security/cve/CVE-2026-41602
https://bugzilla.redhat.com/show_bug.cgi?id=2463407
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41602.json