CVE-2026-41607
Fixed in a distro release EPSS <1%CVSS 6.5
Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Products: Apache Software Foundation Apache Thrift, Red Hat Multicluster Global Hub 1.3.4, Red Hat Multicluster Global Hub 1.4.5, Red Hat Multicluster Global Hub 1.6.5, Red Hat Advanced Cluster Management for Kubernetes 2.14, Red Hat Advanced Cluster Management for Kubernetes 2.15, Red Hat multicluster global hub 1.5.3, Red Hat OpenShift distributed tracing 3.9.3, Red Hat OpenShift Service Mesh 2, Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenShift distributed tracing 3, Red Hat OpenShift GitOps
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | thrift | no fix |
| Debian 13 | thrift | no fix |
| Debian 14 | thrift | 0.23.0-3 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | alloy | 1.18.0-150700.15.26.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | grafana | 12.4.5-150200.3.91.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-aws | 3.11.0-150200.6.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-azurerm | 2.32.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-external | 2.0.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-google | 3.43.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-helm | 2.9.0-150200.6.23.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-kubernetes | 1.13.2-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-local | 2.0.0-150200.6.17.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-null | 3.0.0-150200.6.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-random | 3.0.0-150200.6.15.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-susepubliccloud | 0.0.1-150100.3.14.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-tls | 3.0.0-150200.5.15.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-aws | 3.11.0-150200.6.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-azurerm | 2.32.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-external | 2.0.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-google | 3.43.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-helm | 2.9.0-150200.6.23.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-kubernetes | 1.13.2-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-local | 2.0.0-150200.6.17.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-null | 3.0.0-150200.6.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-random | 3.0.0-150200.6.15.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-susepubliccloud | 0.0.1-150100.3.14.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-tls | 3.0.0-150200.5.15.1 |
| SUSE Linux Enterprise Server 16.0 | alloy | 1.18.0-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | alloy | 1.18.0-160000.1.1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-alertmanager | 0.28.1-150100.4.34.1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-prometheus | 3.5.4-150000.3.75.1 |
| SUSE Manager Client Tools 15 | grafana | 12.4.5-150000.1.98.1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-alertmanager | 0.28.1-150002.4.14.1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.5.4-150002.3.16.1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 12.4.5-150002.4.24.1 |
| Ubuntu 20.04 LTS | thrift | no fix |
| Ubuntu 22.04 LTS | thrift | no fix |
| Ubuntu 24.04 LTS | thrift | no fix |
| Ubuntu 25.10 | thrift | no fix |
| Ubuntu 26.04 LTS | thrift | no fix |
| Ubuntu 26.10 | thrift | no fix |
| openSUSE Leap 16.0 | alloy | 1.18.0-160000.1.1 |
| openSUSE Leap 16.0 | grafana | 12.4.5-bp160.1.1 |
| openSUSE Tumbleweed | alloy | 1.18.0-1.1 |
| openSUSE Tumbleweed | grafana | 11.6.14+security04-4.1 |
| openSUSE Tumbleweed | thrift | 0.23.0-1.1 |