CVE-2026-43869
Fixed in a distro release EPSS <1%CVSS 7.3
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Products: Apache Software Foundation Apache Thrift, Red Hat Cryostat 4 on RHEL 9, Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1, Red Hat Multicluster Global Hub 1.3.4, Red Hat Multicluster Global Hub 1.4.5, Red Hat Multicluster Global Hub 1.6.5, Red Hat Multicluster Global Hub 1.7.0, Red Hat Advanced Cluster Management for Kubernetes 2.13, Red Hat Advanced Cluster Management for Kubernetes 2.14, Red Hat Advanced Cluster Management for Kubernetes 2.15, Red Hat Advanced Cluster Management for Kubernetes 2.16, Red Hat multicluster global hub 1.5.3, Red Hat OpenShift AI 2.25, Red Hat OpenShift distributed tracing 3.10.2, Red Hat Multicluster Global Hub, Red Hat OpenShift Service Mesh 2, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat AI Inference Server, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat Data Grid 8, Red Hat Enterprise Linux 8, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenShift distributed tracing 3, Red Hat OpenStack Platform 18.0
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.thrift:libthrift | 0.23.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | automq | 1.7.4-r1 |
| Chainguard | automq | no fix |
| Chainguard | automq-fips | 1.7.4-r1 |
| Chainguard | automq-fips | no fix |
| Chainguard | druid | no fix |
| Chainguard | kserve-modelmesh | no fix |
| Chainguard | nuxeo-2023 | 2023.45-r13 |
| Chainguard | ranger | no fix |
| Chainguard | solr-9-full | 9.10.1-r14 |
| Chainguard | solr-fips-9-full | 9.10.1-r2 |
| Chainguard | spark-3.5-scala-2.12 | no fix |
| Chainguard | spark-3.5-scala-2.13 | no fix |
| Chainguard | spark-4.0-scala-2.13 | 4.0.2-r11 |
| Chainguard | spark-4.1-scala-2.13 | no fix |
| Chainguard | spark-4.2-scala-2.13 | no fix |
| Chainguard | spark-fips-3.5-scala-2.12 | no fix |
| Chainguard | spark-fips-3.5-scala-2.13 | no fix |
| Chainguard | spark-fips-4.1-scala-2.13 | no fix |
| Chainguard | spark-fips-4.2-scala-2.13 | no fix |
| Chainguard | wavefront-proxy | 13.9-r27 |
| Chainguard | zipkin | 3.6.1-r6 |
| Debian 12 | thrift | no fix |
| Debian 13 | thrift | no fix |
| Debian 14 | thrift | 0.23.0-3 |
| Ubuntu 20.04 LTS | thrift | no fix |
| Ubuntu 22.04 LTS | thrift | no fix |
| Ubuntu 24.04 LTS | thrift | no fix |
| Ubuntu 25.10 | thrift | no fix |
| Ubuntu 26.04 LTS | thrift | no fix |
| Ubuntu 26.10 | thrift | no fix |
| Wolfi | druid | no fix |
| Wolfi | kserve-modelmesh | no fix |
| Wolfi | spark-4.0-scala-2.13 | 4.0.2-r11 |
| Wolfi | spark-4.1-scala-2.13 | no fix |
| Wolfi | wavefront-proxy | 13.9-r27 |
| Wolfi | zipkin | 3.6.1-r6 |