CVE-2026-41607

Apache Thrift: C++ JSON OOB read

MEDIUM

6.5

CVSS Score

Published: April 28, 2026 at 09:21 AM UTC

Updated: October 26, 2026 at 12:10 AM UTC

5 products affected across 2 vendorsThriftOpenShift Container PlatformEnterprise Linux AI

Using Apache Thrift by Apache Software Foundation?

Get instant alerts when new vulnerabilities affect Apache Thrift - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploit prediction

EPSS 0.9%

SSVC

No known exploit

Description

Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Thrift · Apachepypi

95%

All versionsv < 0.23.0

Affected range stops below 0.23.0, so it looks safe — our inference, not a vendor statement

AI Inference Server · Red Hatcontainer

60%

All versions

Enterprise Linux AI · Red Hatrpm

60%

OpenShift Container Platform · Red Hatcontainer

60%

Vendor states this is fixed in 4 (unaffected)

OpenShift Gitops · Red Hatcontainer

60%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql

References (12)

Vendor AdvisoryMailing ListPatchRelease Notes

Source: cverecord

https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql

Mailing List

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2026/04/28/2