CVE-2026-43870
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Apache Thrift before version 0.23.0 contains an origin validation error, improper limitation of a pathname to a restricted directory (path traversal), improper neutralization of CRLF sequences in HTTP headers (HTTP request/response splitting), and uncontrolled resource consumption. These issues may be exploited depending on configuration and library usage.
Risk Assessment
Depending on the scenario, an attacker may access files outside the intended directory, inject HTTP headers, or cause a denial of service. The risk affects applications using Apache Thrift versions older than 0.23.0.
Recommendation
Upgrade Apache Thrift to version 0.23.0, which fixes the described issues. Review applications using Thrift for path and header validation.
Other vulnerabilities in Apache Thrift
See all- CVE-2026-96289High
Apache Thrift PHP bindings before version 0.25.0 are vulnerable to uncontrolled recursion, which can lead to system overload or crashes.
- CVE-2026-96286High
Apache Thrift Perl bindings before version 0.25.0 have an uncaught exception vulnerability, which can lead to unexpected termination of the application.
- CVE-2026-96277High
Apache Thrift Ruby bindings before version 0.25.0 have an uncaught exception and improper handling of exceptional conditions vulnerability, which can lead to application crashes.
- CVE-2026-66859High
NULL pointer dereference and use of uninitialized variable vulnerability in Apache Thrift c_glib bindings. Affects versions before 0.25.0.
- CVE-2026-66858High
Vulnerability in the protocol skip routine in several Apache Thrift bindings that does not apply the recursion limit, allowing deep nesting of unknown fields to exhaust the stack. Affects Python C++ accelerator, PHP, Perl, Lua, Smalltalk, and OCaml libraries. Affects versions before 0.25.0.
- CVE-2026-66837High
Stack-based buffer overflow and integer overflow vulnerability in Apache Thrift PHP bindings. Affects versions before 0.25.0.
- CVE-2026-66081High
Access of uninitialized pointer vulnerability in Apache Thrift c_glib bindings. Affects versions before 0.25.0.
- CVE-2026-96294High
Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
- CVE-2026-96288High
Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
- CVE-2026-94646High
Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Original NVD description (English source)
Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS