{"schema":"threatline.record/2","record":{"id":"CVE-2026-41603","aliases":["GHSA-gf47-qgg5-9g9q"],"summary":"Rejected: This CVE ID is Rejected and will not be used. The record incorrectly described the affected language binding and fixed version. Use CVE-2026-66053, which was assigned to the vulner","details":"Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","categories":["Libraries & packages"],"product":"org.apache.thrift:libthrift","vendor":"","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-gf47-qgg5-9g9q","source_modified_at":"2026-10-28T19:51:11Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"maven","name":"org.apache.thrift:libthrift"},"range":"< 0.23.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-gf47-qgg5-9g9q","source_modified_at":"2026-10-28T20:00:03.959240576Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"org.apache.thrift:libthrift","ecosystem":"Maven","purl":"pkg:maven/org.apache.thrift/libthrift"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}],"versions":["0.10.0","0.11.0","0.12.0","0.13.0","0.14.0","0.14.1","0.14.2","0.15.0","0.16.0","0.17.0","0.18.0","0.18.1","0.19.0","0.20.0","0.21.0","0.22.0","0.6.1","0.7.0","0.8.0","0.9.0","0.9.1","0.9.2","0.9.3","0.9.3-1"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-gf47-qgg5-9g9q","source_modified_at":"2026-10-28T19:51:11Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"maven","name":"org.apache.thrift:libthrift"},"version":"0.23.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-gf47-qgg5-9g9q","source_modified_at":"2026-10-28T20:00:03.959240576Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"org.apache.thrift:libthrift","ecosystem":"Maven","purl":"pkg:maven/org.apache.thrift/libthrift"},"version":"0.23.0"}],"cvss":7.4,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-04-28T09:19:40.564Z","modified_at":"2026-10-28T20:00:03.959240576Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-gf47-qgg5-9g9q","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T19:51:11Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-41603","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-07-27T14:16:46.731Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-gf47-qgg5-9g9q","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T20:00:03.959240576Z"}],"sources":["GitHub Advisory Database","CVE List","OSV"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41603","source":"GitHub Advisory Database"},{"url":"https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql","source":"GitHub Advisory Database"},{"url":"https://access.redhat.com/errata/RHSA-2026:14885","source":"GitHub Advisory Database"},{"url":"https://access.redhat.com/errata/RHSA-2026:21769","source":"GitHub Advisory Database"},{"url":"https://access.redhat.com/errata/RHSA-2026:22347","source":"GitHub Advisory Database"},{"url":"https://access.redhat.com/errata/RHSA-2026:22423","source":"GitHub Advisory Database"},{"url":"https://access.redhat.com/errata/RHSA-2026:23345","source":"GitHub Advisory Database"},{"url":"https://access.redhat.com/errata/RHSA-2026:24539","source":"GitHub Advisory Database"},{"url":"https://access.redhat.com/security/cve/CVE-2026-41603","source":"GitHub Advisory Database"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463411","source":"GitHub Advisory Database"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41603.json","source":"GitHub Advisory Database"},{"url":"https://access.redhat.com/errata/RHSA-2026:36882","source":"GitHub Advisory Database"},{"url":"https://github.com/apache/thrift/commit/0919c3d5506151514e283a63e1fe1ce83e2449d8","source":"GitHub Advisory Database"},{"url":"https://github.com/apache/thrift/commit/a30c552bd0808b7e19f35ad30212ba7a9aee8c66","source":"GitHub Advisory Database"},{"url":"https://github.com/apache/thrift/releases/tag/v0.23.0","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-gf47-qgg5-9g9q","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"REJECTED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T20:00:03.959240576Z","content_hash":"1e359f81a5596487032aa2437b29e782306cc8c1ba47283687869e5e68ac564f"}}