All vulnerabilities
CVE-2026-41603GHSA-gf47-qgg5-9g9q

org.apache.thrift:libthrift: Rejected: This CVE ID is Rejected and will not be used. The record incorrectly described the affected language binding and fixed version. Use CVE-2026-66053, which was assigned to the vulner

org.apache.thrift:libthriftmavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.4High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in0.23.0Fixed versionGitHub
Published28 Apr 2026Updated 28 Oct 2026CVE List

What fixes it

  • 0.23.0org.apache.thrift:libthrift, mavenGitHub<dependency><groupId>org.apache.thrift</groupId><artifactId>libthrift</artifactId><version>0.23.0</version></dependency>
  • 0.23.0org.apache.thrift:libthrift, MavenOSV<dependency><groupId>org.apache.thrift</groupId><artifactId>libthrift</artifactId><version>0.23.0</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Text from GitHub Advisory Database

Affected versions 26

  • org.apache.thrift:libthrift, maven< 0.23.0GitHub
  • org.apache.thrift:libthrift, Mavenfrom first release, fixed in 0.23.0OSV
  • org.apache.thrift:libthrift, Maven0.10.0OSV
  • org.apache.thrift:libthrift, Maven0.11.0OSV
  • org.apache.thrift:libthrift, Maven0.12.0OSV
  • org.apache.thrift:libthrift, Maven0.13.0OSV
  • org.apache.thrift:libthrift, Maven0.14.0OSV
  • org.apache.thrift:libthrift, Maven0.14.1OSV
  • org.apache.thrift:libthrift, Maven0.14.2OSV
  • org.apache.thrift:libthrift, Maven0.15.0OSV
  • org.apache.thrift:libthrift, Maven0.16.0OSV
  • org.apache.thrift:libthrift, Maven0.17.0OSV
  • org.apache.thrift:libthrift, Maven0.18.0OSV
  • org.apache.thrift:libthrift, Maven0.18.1OSV
  • org.apache.thrift:libthrift, Maven0.19.0OSV
  • org.apache.thrift:libthrift, Maven0.20.0OSV
  • org.apache.thrift:libthrift, Maven0.21.0OSV
  • org.apache.thrift:libthrift, Maven0.22.0OSV
  • org.apache.thrift:libthrift, Maven0.6.1OSV
  • org.apache.thrift:libthrift, Maven0.7.0OSV
  • org.apache.thrift:libthrift, Maven0.8.0OSV
  • org.apache.thrift:libthrift, Maven0.9.0OSV
  • org.apache.thrift:libthrift, Maven0.9.1OSV
  • org.apache.thrift:libthrift, Maven0.9.2OSV
  • org.apache.thrift:libthrift, Maven0.9.3OSV
  • org.apache.thrift:libthrift, Maven0.9.3-1OSV

References 16