{"id":"CVE-2026-41605","state":"PUBLISHED","title":"Apache Thrift: Swift Compact Protocol integer overflow","description":"Integer Overflow or Wraparound vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","publishedAt":"2026-04-28T09:20:44.319Z","updatedAt":"2026-09-09T12:04:44.636Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache Thrift"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Thrift","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.23.0","versionType":"semver"}]}],"references":["https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql","http://www.openwall.com/lists/oss-security/2026/04/28/4","https://access.redhat.com/security/cve/CVE-2026-41605","https://bugzilla.redhat.com/show_bug.cgi?id=2463418","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41605.json","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:24539","https://access.redhat.com/errata/RHSA-2026:14885","https://access.redhat.com/errata/RHSA-2026:21769"],"weaknesses":["CWE-190"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/41xxx/CVE-2026-41605.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-41605","state":"PUBLISHED","datePublished":"2026-04-28T09:20:44.319Z","dateUpdated":"2026-09-09T12:04:44.636Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2026-04-21T21:32:12.142Z"},"containers":{"cna":{"title":"Apache Thrift: Swift Compact Protocol integer overflow","descriptions":[{"lang":"en","value":"Integer Overflow or Wraparound vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Thrift","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"0.23.0","versionType":"semver"}]}],"references":[{"url":"https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql","tags":["vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"important"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-190","description":"CWE-190 Integer Overflow or Wraparound","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2026-04-28T09:20:44.319Z"},"credits":[{"lang":"en","type":"finder","value":"Hasnain Lakhani"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/04/28/4"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-04-28T09:52:07.473Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-04-28T14:27:07.615327Z","id":"CVE-2026-41605","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-28T14:27:11.129Z"}},{"title":"Apache Thrift: Apache Thrift: Integer Overflow or Wraparound Vulnerability","descriptions":[{"lang":"en","value":"A flaw was found in Apache Thrift. This integer overflow or wraparound vulnerability could potentially lead to unexpected behavior or resource exhaustion, which may impact the availability or integrity of the system. The exact consequences depend on how the overflow is triggered and handled within the application."}],"affected":[{"vendor":"Red Hat","product":"Multicluster Global Hub 1.3.4","packageName":"multicluster-globalhub/multicluster-globalhub-grafana-rhel9","defaultStatus":"affected","versions":[{"version":"1779212259","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:multicluster_globalhub:1.3::el9"]},{"vendor":"Red Hat","product":"Multicluster Global Hub 1.4.5","packageName":"multicluster-globalhub/multicluster-globalhub-grafana-rhel9","defaultStatus":"affected","versions":[{"version":"1779579439","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:multicluster_globalhub:1.4::el9"]},{"vendor":"Red Hat","product":"Multicluster Global Hub 1.6.5","packageName":"multicluster-globalhub/multicluster-globalhub-grafana-rhel9","defaultStatus":"affected","versions":[{"version":"1780167118","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:multicluster_globalhub:1.6::el9"]},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2.14","packageName":"rhacm2/acm-grafana-rhel9","defaultStatus":"affected","versions":[{"version":"1782693386","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:acm:2.14::el9"]},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Management for Kubernetes 2.15","packageName":"rhacm2/acm-grafana-rhel9","defaultStatus":"affected","versions":[{"version":"1780677003","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:acm:2.15::el9"]},{"vendor":"Red Hat","product":"Red Hat multicluster global hub 1.5.3","packageName":"multicluster-globalhub/multicluster-globalhub-grafana-rhel9","defaultStatus":"affected","versions":[{"version":"1778867753","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:multicluster_globalhub:1.5::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift distributed tracing 3.9.3","packageName":"rhosdt/tempo-jaeger-query-rhel9","defaultStatus":"affected","versions":[{"version":"1778158391","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift distributed tracing 3.9.3","packageName":"rhosdt/tempo-query-rhel9","defaultStatus":"affected","versions":[{"version":"1778158343","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift distributed tracing 3.9.3","packageName":"rhosdt/tempo-rhel9","defaultStatus":"affected","versions":[{"version":"1778158374","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"]},{"vendor":"Red Hat","product":"OpenShift Service Mesh 2","packageName":"openshift-service-mesh/istio-rhel8-operator","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_mesh:2"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server","packageName":"rhaiis/vllm-cpu-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server","packageName":"rhaiis/vllm-cuda-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server","packageName":"rhaiis/vllm-rocm-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server","packageName":"rhaiis/vllm-tpu-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-aws-cuda-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-azure-cuda-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-azure-rocm-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-cuda-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-gcp-cuda-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","packageName":"rhelai3/bootc-rocm-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-kf-notebook-controller-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-model-registry-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-notebook-controller-rhel8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/oc-mirror-plugin-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ztp-site-generate-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift distributed tracing 3","packageName":"rhosdt/opentelemetry-collector-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_distributed_tracing:3"]},{"vendor":"Red Hat","product":"Red Hat OpenShift GitOps","packageName":"openshift-gitops-1/argocd-rhel8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_gitops:1"]},{"vendor":"Red Hat","product":"Red Hat OpenShift GitOps","packageName":"openshift-gitops-1/argocd-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_gitops:1"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-41605","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463418","name":"RHBZ#2463418","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41605.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22423","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22347","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23345","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36882","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24539","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14885","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21769","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-190","description":"Integer Overflow or Wraparound","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-09-09T12:04:44.636Z"},"datePublic":"2026-04-28T09:20:44.319Z","solutions":[{"lang":"en","value":"RHSA-2026:22423: Multicluster Global Hub 1.3.4"},{"lang":"en","value":"RHSA-2026:22347: Multicluster Global Hub 1.4.5"},{"lang":"en","value":"RHSA-2026:23345: Multicluster Global Hub 1.6.5"},{"lang":"en","value":"RHSA-2026:36882: Red Hat Advanced Cluster Management for Kubernetes 2.14"},{"lang":"en","value":"RHSA-2026:24539: Red Hat Advanced Cluster Management for Kubernetes 2.15"},{"lang":"en","value":"RHSA-2026:14885: Red Hat OpenShift distributed tracing 3.9.3"},{"lang":"en","value":"RHSA-2026:21769: Red Hat multicluster global hub 1.5.3"}],"timeline":[{"lang":"en","time":"2026-04-28T10:01:54.269Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-28T09:20:44.319Z","value":"Made public."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}