CVE-2026-43868

Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern

MEDIUM

5.3

CVSS Score

Published: May 5, 2026 at 07:49 AM UTC

Updated: October 26, 2026 at 07:10 PM UTC

5 products affected across 2 vendorsThriftOpenShift AIFuse

Using Apache Thrift by Apache Software Foundation?

Get instant alerts when new vulnerabilities affect Apache Thrift - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.3

Exploit prediction

EPSS 0.7%

SSVC

No known exploit

Description

Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Thrift · Apachepypi

95%

v < 0.23.0

Affected range stops below 0.23.0, so it looks safe — our inference, not a vendor statement

AI Inference Server · Red Hatcontainer

60%

All versions

Build of Apache Camel for Quarkus · Red Hatrpm

60%

Fuse · Red Hatrpm

60%

OpenShift AI · Red Hatcontainer

60%

All versions

Vendor states this is fixed in 1783443816 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://lists.apache.org/thread/zj76dtwnbbs1m7z3focf4wd51pqpsmn9