CVE-2026-41605
Fixed in a distro release EPSS <1%CVSS 7.3
Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Products: Apache Software Foundation Apache Thrift, Red Hat Multicluster Global Hub 1.3.4, Red Hat Multicluster Global Hub 1.4.5, Red Hat Multicluster Global Hub 1.6.5, Red Hat Advanced Cluster Management for Kubernetes 2.14, Red Hat Advanced Cluster Management for Kubernetes 2.15, Red Hat multicluster global hub 1.5.3, Red Hat OpenShift distributed tracing 3.9.3, Red Hat OpenShift Service Mesh 2, Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenShift distributed tracing 3, Red Hat OpenShift GitOps
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | thrift | no fix |
| Debian 13 | thrift | no fix |
| Debian 14 | thrift | 0.23.0-3 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-aws | 3.11.0-150200.6.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-azurerm | 2.32.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-external | 2.0.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-google | 3.43.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-helm | 2.9.0-150200.6.23.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-kubernetes | 1.13.2-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-local | 2.0.0-150200.6.17.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-null | 3.0.0-150200.6.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-random | 3.0.0-150200.6.15.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-susepubliccloud | 0.0.1-150100.3.14.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-tls | 3.0.0-150200.5.15.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-aws | 3.11.0-150200.6.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-azurerm | 2.32.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-external | 2.0.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-google | 3.43.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-helm | 2.9.0-150200.6.23.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-kubernetes | 1.13.2-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-local | 2.0.0-150200.6.17.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-null | 3.0.0-150200.6.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-random | 3.0.0-150200.6.15.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-susepubliccloud | 0.0.1-150100.3.14.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-tls | 3.0.0-150200.5.15.1 |
| Ubuntu 20.04 LTS | thrift | no fix |
| Ubuntu 22.04 LTS | thrift | no fix |
| Ubuntu 24.04 LTS | thrift | no fix |
| Ubuntu 25.10 | thrift | no fix |
| Ubuntu 26.04 LTS | thrift | no fix |
| Ubuntu 26.10 | thrift | no fix |
| openSUSE Tumbleweed | thrift | 0.23.0-1.1 |