CVE-2026-41602
published 2026-04-28CVE-2026-41602: Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.16%
64.0th percentile
Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | < 0.23.0 | 0.23.0 |
| apache_software_foundation | apache_thrift | < 0.23.0 | 0.23.0 |
| github.com | apache_thrift | >= 0 < 0.23.0 | 0.23.0 |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel8 | — | — |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| openshift-gitops-1 | argocd-rhel8 | — | — |
| openshift-gitops-1 | argocd-rhel9 | — | — |
| openshift-service-mesh | istio-rhel8-operator | — | — |
| openshift4 | oc-mirror-plugin-rhel9 | — | — |
| rhacm2 | acm-grafana-rhel9 | — | — |
| rhaiis | vllm-cpu-rhel9 | — | — |
| rhaiis | vllm-tpu-rhel9 | — | — |
| rhceph | alloy-rhel10 | — | — |
| rhceph | grafana-rhel10 | — | — |
| rhceph | rhceph-6-dashboard-rhel9 | — | — |
| rhceph | snmp-notifier-rhel10 | — | — |
| rhceph | snmp-notifier-rhel8 | — | — |
| rhceph | snmp-notifier-rhel9 | — | — |
| rhosdt | opentelemetry-collector-rhel9 | — | — |
| rhosdt | tempo-jaeger-query-rhel9 | — | — |
| rhosdt | tempo-query-rhel9 | — | — |
| rhosdt | tempo-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation
vendor_redhat·2026-04-28·CVSS 7.5
CVE-2026-41602 [HIGH] CWE-190 github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation
github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation
A flaw was found in the Apache Thrift TFramedTransport Go language implementation. This integer overflow or wraparound vulnerability could potentially allow an attacker to cause unexpected behavior or resource exhaustion, leading to a denial of service.
Package: multicluster-globalhub/multicluster-globalhub-grafana-rhel8 (Multicluster Global Hub) - Affected
Package: multicluster-globalhub/multicluster-globalhub-grafana-rhel9 (Multicluster Global Hub) - Affected
Package: openshift-service-mesh/istio-rhel8-operator (OpenShift Service Mesh 2) - Affected
Package: rhacm2/acm-grafana-rhel9 (Red Hat Advanced Cluster Management for Kubernetes 2) - Affected
Package: rhaiis/vllm-cpu-rhel9 (Red Hat A
VulDB
Apache Thrift up to 0.22.0 Go TFramedTransport integer overflow
vuldb·2026-04-28
CVE-2026-41602 [CRITICAL] Apache Thrift up to 0.22.0 Go TFramedTransport integer overflow
A vulnerability identified as critical has been detected in Apache Thrift up to 0.22.0. This impacts an unknown function of the component Go TFramedTransport. Performing a manipulation results in integer overflow.
This vulnerability is reported as CVE-2026-41602. The attack is possible to be carried out remotely. No exploit exists.
You should upgrade the affected component.
GHSA
Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerability
ghsa·2026-04-28
CVE-2026-41602 [HIGH] CWE-190 Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerability
Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerability
Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-41602 golang-github-apache-thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation [fedora-all]
bugzilla·2026-04-30
CVE-2026-41602 [HIGH] CVE-2026-41602 golang-github-apache-thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation [fedora-all]
CVE-2026-41602 golang-github-apache-thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41602 github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation
bugzilla·2026-04-28
CVE-2026-41602 [HIGH] CVE-2026-41602 github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation
CVE-2026-41602 github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation
Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwqlhttp://www.openwall.com/lists/oss-security/2026/04/28/6https://access.redhat.com/errata/RHSA-2026:14162https://access.redhat.com/errata/RHSA-2026:14885https://access.redhat.com/errata/RHSA-2026:21769https://access.redhat.com/errata/RHSA-2026:22347https://access.redhat.com/errata/RHSA-2026:22423https://access.redhat.com/errata/RHSA-2026:23345https://access.redhat.com/errata/RHSA-2026:24503https://access.redhat.com/errata/RHSA-2026:24539https://access.redhat.com/errata/RHSA-2026:25273https://access.redhat.com/errata/RHSA-2026:36882https://access.redhat.com/security/cve/CVE-2026-41602https://bugzilla.redhat.com/show_bug.cgi?id=2463407https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41602.json
2026-04-28
Published