CVE-2026-43870
Fixed in a distro release EPSS <1%CVSS 7.3
Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Products: Apache Software Foundation Apache Thrift
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | thrift | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | commercial-gitlab-rails-ee-assets-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-assets-19.2 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-19.3 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-19.4 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-19.5 | no fix |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.2 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.3 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.4 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.5 | no fix |
| Chainguard | gitlab-rails-ce-assets-18.1 | no fix |
| Chainguard | gitlab-rails-ce-assets-18.10 | 18.10.5-r2 |
| Chainguard | gitlab-rails-ce-assets-18.11 | 18.11.2-r1 |
| Chainguard | gitlab-rails-ce-assets-18.3 | 18.3.6-r6 |
| Chainguard | gitlab-rails-ce-assets-18.4 | no fix |
| Chainguard | gitlab-rails-ce-assets-18.5 | no fix |
| Chainguard | gitlab-rails-ce-assets-18.6 | 18.6.6-r4 |
| Chainguard | gitlab-rails-ce-assets-18.7 | no fix |
| Chainguard | gitlab-rails-ce-assets-18.8 | no fix |
| Chainguard | gitlab-rails-ce-assets-18.9 | no fix |
| Chainguard | gitlab-rails-ce-assets-19.0 | no fix |
| Chainguard | gitlab-rails-ce-assets-19.1 | no fix |
| Chainguard | gitlab-rails-ce-assets-19.2 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.3 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.4 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.5 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-18.1 | 18.1.6-r10 |
| Chainguard | gitlab-rails-ce-assets-fips-18.10 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-18.11 | 18.11.2-r1 |
| Chainguard | gitlab-rails-ce-assets-fips-18.3 | 18.3.6-r7 |
| Chainguard | gitlab-rails-ce-assets-fips-18.4 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-18.9 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-19.0 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-19.1 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-19.2 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.3 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.4 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.5 | no fix |
| Debian 12 | thrift | no fix |
| Debian 13 | thrift | no fix |
| Debian 14 | thrift | 0.23.0-3 |
| Red Hat Enterprise Linux eus 10.0 | opentelemetry-collector | 0:0.152.1-1.el10_0 |
| Red Hat rhel e4s 9.4 | opentelemetry-collector | 0:0.152.1-1.el9_4 |
| Red Hat rhel eus 9.6 | opentelemetry-collector | 0:0.152.1-1.el9_6 |
| Ubuntu 20.04 LTS | thrift | no fix |
| Ubuntu 22.04 LTS | thrift | no fix |
| Ubuntu 24.04 LTS | thrift | no fix |
| Ubuntu 25.10 | thrift | no fix |
| Ubuntu 26.04 LTS | thrift | no fix |
| Ubuntu 26.10 | thrift | no fix |