CVE-2026-41604

HighCVSS 8.2/10Last modified Oct 26, 2026

Description

Out-of-bounds Read vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
Apache Software FoundationApache Thrift< 0.23.0
Red HatMulticluster Global Hub 1.3.4—
Red HatMulticluster Global Hub 1.4.5—
Red HatMulticluster Global Hub 1.6.5—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.14—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.15—
Red HatRed Hat multicluster global hub 1.5.3—
Red HatRed Hat OpenShift distributed tracing 3.9.3—
Red HatRed Hat OpenShift distributed tracing 3.9.3—
Red HatRed Hat OpenShift distributed tracing 3.9.3—
Red HatOpenShift Service Mesh 2—
Red HatRed Hat AI Inference Server—
Red HatRed Hat AI Inference Server—
Red HatRed Hat AI Inference Server—
Red HatRed Hat AI Inference Server—
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3—
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3—
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3—
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3—
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3—
Red HatRed Hat Enterprise Linux AI (RHEL AI) 3—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift distributed tracing 3—
Red HatRed Hat OpenShift GitOps—
Red HatRed Hat OpenShift GitOps—

References

Timeline

Published
Apr 28, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-416057.3Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to uCVE-2026-416065.3Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade tCVE-2026-416076.5Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to veCVE-2026-416087.5Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache CVE-2026-41614.4The Review Map by RevuKangaroo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up CVE-2026-416105.0Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker tCVE-2026-416113.3Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execuCVE-2026-416125.5Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.CVE-2026-416138.8Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.CVE-2026-416146.2Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.CVE-2026-416157.4Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose informatioCVE-2026-41627.1The Gravity SMTP plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.4. This is due to the plu