CVE-2026-55971

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

VendorProductVersions
Apache Software FoundationApache Thrift< 0.24.0

References

Timeline

Published
Jul 27, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-559737.5In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) frCVE-2026-559757.2A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device's certificCVE-2026-559769.1Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CVE-2026-559773.3Successful exploitation of this vulnerability could allow an attacker with local network access to bypass the application's rate-limiting meCVE-2026-559788.4An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel CVE-2026-559795.2An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. CVE-2026-55987.5Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associatCVE-2026-559805.5A denial-of-service vulnerability in CatchPulse could allow an attacker to conduct a stack buffer overrun attack, leading to a denial-of-serCVE-2026-559819.6A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and uplCVE-2026-559829.1OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token ScopesCVE-2026-559842.7Null Pointer Dereference in AddTime API Causes Authenticated Denial of ServiceCVE-2026-559854.3The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configura
CVE-2026-55971: Critical severity, CVSS 9.8 | Vulnix