CVE-2026-41602

Apache Thrift: Go TFramedTransport uint32 overflow

HIGH

7.5

CVSS Score

Published: April 28, 2026 at 09:19 AM UTC

Updated: September 9, 2026 at 01:19 PM UTC

4 products affected across 2 vendorsThriftAI Inference ServerOpenShift Gitops

Using Apache Thrift by Apache Software Foundation?

Get instant alerts when new vulnerabilities affect Apache Thrift - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 1%

SSVC

No known exploit

Description

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Thrift · Apachepypi

95%

v < 0.23.0

Affected range stops below 0.23.0, so it looks safe — our inference, not a vendor statement

AI Inference Server · Red Hatcontainer

60%

All versions

Multicluster Global Hub · Red Hatcontainer

60%

All versions

Vendor states this is fixed in 1778867753 (unaffected)

Vendor states this is fixed in 1779212259 (unaffected)

Vendor states this is fixed in 1779579439 (unaffected)

Vendor states this is fixed in 1779925273 (unaffected)

Vendor states this is fixed in 1780167118 (unaffected)

OpenShift Gitops · Red Hatcontainer

60%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql

References (15)

Vendor AdvisoryMailing ListPatchRelease Notes

Source: cverecord

https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql

Mailing List

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2026/04/28/6