CVE-2026-41636
Fixed in a distro release EPSS <1%CVSS 8.7
Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Products: Apache Software Foundation Apache Thrift
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | thrift | 0.23.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | commercial-gitlab-rails-ee-assets-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-assets-19.2 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-19.3 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-19.4 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-19.5 | no fix |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.2 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.3 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.4 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.5 | no fix |
| Chainguard | gitlab-rails-ce-assets-18.1 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.10 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.11 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.3 | no fix |
| Chainguard | gitlab-rails-ce-assets-18.4 | no fix |
| Chainguard | gitlab-rails-ce-assets-18.5 | no fix |
| Chainguard | gitlab-rails-ce-assets-18.6 | no fix |
| Chainguard | gitlab-rails-ce-assets-18.7 | no fix |
| Chainguard | gitlab-rails-ce-assets-18.8 | no fix |
| Chainguard | gitlab-rails-ce-assets-18.9 | 18.9.6-r2 |
| Chainguard | gitlab-rails-ce-assets-19.0 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.1 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.2 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.3 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.4 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.5 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-18.10 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.11 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.3 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-18.4 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-18.9 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-19.0 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.1 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.2 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.3 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.4 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.5 | 0 |
| Debian 12 | thrift | no fix |
| Debian 13 | thrift | no fix |
| Debian 14 | thrift | 0.23.0-3 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-aws | 3.11.0-150200.6.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-azurerm | 2.32.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-external | 2.0.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-google | 3.43.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-helm | 2.9.0-150200.6.23.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-kubernetes | 1.13.2-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-local | 2.0.0-150200.6.17.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-null | 3.0.0-150200.6.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-random | 3.0.0-150200.6.15.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-susepubliccloud | 0.0.1-150100.3.14.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | terraform-provider-tls | 3.0.0-150200.5.15.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-aws | 3.11.0-150200.6.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-azurerm | 2.32.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-external | 2.0.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-google | 3.43.0-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-helm | 2.9.0-150200.6.23.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-kubernetes | 1.13.2-150200.6.12.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-local | 2.0.0-150200.6.17.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-null | 3.0.0-150200.6.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-random | 3.0.0-150200.6.15.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-susepubliccloud | 0.0.1-150100.3.14.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | terraform-provider-tls | 3.0.0-150200.5.15.1 |
| Ubuntu 20.04 LTS | thrift | no fix |
| Ubuntu 22.04 LTS | thrift | no fix |
| Ubuntu 24.04 LTS | thrift | no fix |
| Ubuntu 25.10 | thrift | no fix |
| Ubuntu 26.04 LTS | thrift | no fix |
| Ubuntu 26.10 | thrift | no fix |
| openSUSE Tumbleweed | thrift | 0.23.0-1.1 |