Apache Thrift Hit by 5 Vulnerabilities: Traffic Eavesdropping and Service Outage Risks (CVE-2026-48144, CVSS 9.1)—Update to 0.24.0

Five vulnerabilities (software weaknesses) have been found together in Apache Thrift, the communication framework that quietly handles "software talking to software" behind many systems. The most dangerous one could let a third party eavesdrop on or tamper with traffic that is supposed to be encrypted, and it is rated 9.1 out of 10 in severity (CVE-2026-48144).

The other four are mostly "denial of service" issues, where crafted data is sent to make a service unresponsive. The Apache Software Foundation has released version 0.24.0, which fixes every one of these flaws. The fix is to update to that version. So far there are no reports of these being used in real attacks (no entry on the U.S. government list described later). The first step is to calmly check whether the systems you run are actually affected.

A quick table of the five vulnerabilities

Which of the five affects you depends on which per-language component (language binding) of Apache Thrift you use. Here is the overall picture. The severity figures are CVSS 4.0, an international scale that rates a vulnerability's danger out of 10.

Roughly speaking, there are two "impersonation" flaws that lead to eavesdropping (c_glib and C++) and three "disruption" flaws that stop a service (Python, Go, PHP, Java). All five are fixed in 0.24.0, so the goal of the fix is the same for everyone. Each ID is explained one by one below.

What Apache Thrift is, and why it is so widely used

Apache Thrift is an open-source communication framework that was originally built in-house at Facebook (now Meta) and later donated to the Apache Software Foundation. In one sentence, its job is to be "a translator that lets software written in different programming languages exchange data by the same rules."

For example, you might want an inventory component written in C++, a display component written in Python, and an aggregation component written in Java to work together inside one service. According to the Apache Thrift official site, it supports more than a dozen languages including C++, Java, Python, PHP, Ruby, Go, C#, and Node.js. Once you define the data format and the communication procedure, it automatically generates the networking code for each language.

This "auto-generated networking code" runs silently as the foundation of many systems. It is common in large data-processing platforms and in microservices (an approach that splits functions into small components that cooperate), and users usually never notice Thrift directly. That is exactly what makes it tricky: you can be affected without even realizing your service uses Thrift. The reason this vulnerability is relevant to a wide audience is precisely this "invisibility of foundational software."

Who is being targeted, and what is the goal

Numbers and jargon alone make it hard to judge "does this affect me," so let us plainly lay out who would exploit these flaws and what they are after.

For the eavesdropping type (CVE-2026-48144 and CVE-2026-48145), the ones to watch out for are third parties positioned to slip into the path of the communication. Concretely, that means an attacker already inside a corporate network, or someone who controls a public Wi-Fi or a network route. Rather than a random remote attack, the target is a party sitting "in a position to get between the two ends of the conversation."

That party exploits Thrift's weak checking of the other side's identity (the server certificate) to impersonate the legitimate server and eavesdrop on, or quietly rewrite, exchanges that should be encrypted. To the user it looks like they are talking to the right party, when in fact everything is passing through an impostor.

The damage differs by role. For end users of a service, login IDs and authentication tokens could be stolen, or the responses coming back could be swapped out. For the companies and organizations that run the systems, having internal traffic observed is itself a data leak, and combined with the disruption-type flaws described below, the service itself can be taken down. That is why updating to 0.24.0, shown in the mitigation section, is the key.

Similar Apache communication libraries have repeatedly turned up flaws in how received data is handled. Not long ago, Apache MINA had a flaw that let attackers take over a server without logging in. The same hard problem — "how far should you trust data arriving from outside" — appears again here in Thrift, in a different form.

A closer look at each vulnerability

Here are the five, one by one. For readers who arrived by searching a specific ID, they are ordered from most to least dangerous.

CVE-2026-48144: c_glib allows impersonation of the peer (most dangerous)

In the C-family "c_glib" binding, when using encrypted communication (TLS), the code did not correctly match the hostname on the connection's certificate. A certificate is like an ID card saying "this party is genuine," but the check that its name (hostname) matches the actual destination was weak, so someone else's valid certificate could slip through. This enables a "man-in-the-middle" attack that gets between the two ends. It is classified as certificate hostname mismatch (CWE-297) and rated 9.1 (Critical) on CVSS 4.0, the highest of the five. c_glib versions before 0.24.0 are affected.

CVE-2026-43871: Python, Go, PHP, and Java bindings hang in an infinite loop

This is an inescapable repeating process (infinite loop, CWE-835) that spans four language bindings: Python, Go, PHP, and Java. When an attacker sends crafted data, Thrift enters a loop it never exits while trying to process it, and the service can no longer respond. It is dangerous because it can be triggered from outside without logging in, and it is rated 8.7 (High) on CVSS 4.0. It affects the most languages of the five, so it can apply whether you installed via Python (PyPI), Go, PHP (Packagist), or Java (Maven).

CVE-2026-48145: the C++ binding also checks certificates too loosely

The same kind of issue as CVE-2026-48144 occurs, this time in the C++ binding. During encrypted communication it fails to fully verify the certificate's hostname (CWE-297), allowing impersonation. The conditions to pull off the attack are somewhat stricter, so the rating is slightly lower at 8.2 (High) on CVSS 4.0, but the result — eavesdropping and tampering — is the same. If you build your own server or client in C++, be careful.

CVE-2026-45112: the Java binding exhausts memory and stops

In the Java binding (org.apache.thrift:libthrift), the code set no upper limit on the memory used for received data (CWE-770). If sent data that demands a large amount of memory, the server runs out of memory and stops. Versions from 0.19.0 through the 0.23 series are affected, and it is rated 6.9 (Medium) on CVSS 4.0. On its own it does not lead to takeover, but it is material for a service outage.

CVE-2026-41608: the Python binding stops due to compressed-data blowup

In the Python binding, the code did not account for the blowup that happens when expanding extremely compressed data (CWE-409). By abusing the property that tiny compressed data balloons when expanded, an attacker can exhaust a server's processing capacity with very little data — close to a "decompression bomb." CVSS is not yet rated at this time, but Apache advises the fix in 0.24.0. The severity number simply has not been assigned yet; that does not mean no action is needed.

Check whether your system is affected, by language

Which vulnerabilities are relevant depends on "which language you use Thrift with." Picture the language bindings your service uses, and check the matching row below. In every case, the fix is the same: update to 0.24.0.

If you use several language bindings, that many more vulnerabilities apply to you. Setups that use encrypted communication with c_glib or C++ in particular fall under the critical/high eavesdropping type, so they deserve higher priority.

What you should do

The fundamental fix is to update Apache Thrift to 0.24.0 or later. All five flaws are fixed in that version. You can get it from the Apache Thrift download page, but since most sites install via per-language package managers, the quickest route is:

• Python: update with pip install "thrift>=0.24.0"
• Java: move org.apache.thrift:libthrift in Maven / Gradle to 0.24.0
• Go: go get the module to 0.24.0 or later
• PHP: move apache/thrift to 0.24.0 via Composer
• C++ / c_glib: rebuild from the 0.24.0 source

If you cannot update immediately, temporary mitigations include not exposing Thrift's communication port directly to untrusted networks, and setting limits on the size and processing time of data arriving from outside. But these only buy time; the real fix is the update. To map out which components your software depends on, the approach of auditing open-source dependencies helps. With foundational software, the biggest gap is "not knowing you use it," so starting from a dependency inventory is the sure way.

Note that as of now, these five are not listed on the "Known Exploited Vulnerabilities (KEV)" catalog — the list of vulnerabilities actually being exploited — published by the U.S. agency CISA. The latest state of the CISA KEV changes constantly, so if any of these are added, consider the urgency to jump a level. This is not a moment to panic, but neither is it one to ignore.

A technical view: why the same kinds of holes keep recurring

These five split into two "common pitfalls": certificate verification in encrypted communication, and control over how much received data is processed. Both reflect a weakness peculiar to multi-language libraries that port the same feature across many languages.

Certificate hostname verification (CVE-2026-48144 and CVE-2026-48145) is a classic hole: even when the encryption itself works, if you do not match the other party's name, you end up with "encrypted communication with an impostor." Because each language implements TLS differently, one language may verify correctly while another binding still has a gap. The separate IDs assigned to c_glib and C++ this time are a textbook example.

The remaining three (infinite loop, memory exhaustion, decompression bomb) all stem from loose limits on "how much data arriving from outside you accept and process." In a communication framework like Thrift that receives data from unspecified parties, quality means not just handling correct data but protecting yourself when someone sends deliberately extreme data. That the same Apache library keeps having received-data flaws reflects this difficulty. Related cases are also organized in our article on auditing open-source dependencies.

Summary

The five vulnerabilities found in Apache Thrift break down into two "impersonation" flaws that lead to eavesdropping and three "disruption" flaws that stop a service. The most dangerous is CVE-2026-48144 in the c_glib binding (severity 9.1), but the widest reach belongs to CVE-2026-43871, which spans four languages. All are resolved by updating to 0.24.0.

Because Thrift stays out of sight, it is easy to be affected without realizing you use it. There are no reports of active exploitation yet, but first confirm which language binding makes your service depend on Thrift, and plan the update to 0.24.0. If any of these are added to the KEV catalog or new vulnerabilities appear, we will update this article.

Sources

• ▸ NVD - CVE-2026-48144 (c_glib certificate validation, CVSS 9.1)
• ▸ NVD - CVE-2026-43871 (Python/Go/PHP/Java infinite loop, CVSS 8.7)
• ▸ NVD - CVE-2026-48145 (C++ certificate validation, CVSS 8.2)
• ▸ NVD - CVE-2026-45112 (Java resource exhaustion, CVSS 6.9)
• ▸ NVD - CVE-2026-41608 (Python data amplification, not yet rated)
• ▸ Apache Thrift official site
• ▸ Apache Thrift download (0.24.0)