CVE-2026-85086
published 2026-10-02CVE-2026-85086: Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue affects Apache…
PriorityP336medium6.9CVSS 4.0
AVNACLATPPRNUINVCHVIHVANSCNSINSANEUCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.18%
7.1th percentile
Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
CVSS provenance
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings.
ghsa_unreviewed·2026-10-02
CVE-2026-85086 [MEDIUM] CWE-295 Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings.
Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Red Hat
thrift: thrift: Information disclosure via improper certificate validation in Perl bindings
vendor_redhat·2026-10-02·CVSS 6.9
CVE-2026-85086 [MEDIUM] CWE-295 thrift: thrift: Information disclosure via improper certificate validation in Perl bindings
thrift: thrift: Information disclosure via improper certificate validation in Perl bindings
A flaw was found in Apache Thrift's Perl bindings. Due to insecure default settings and improper certificate validation, client connections fail to verify the authenticity of remote server certificates. An unauthenticated attacker positioned on the network could exploit this vulnerability to conduct a man-in-the-middle (MitM) attack, allowing them to eavesdrop on or alter transmitted data and resulting in information disclosure.
Package: thrift (Red Hat Ceph Storage 7) - Affected
Package: thrift (Red Hat Ceph Storage 8) - Affected
Package: thrift (Red Hat Ceph Storage 9) - Affected
Package: thrift (Red Hat Enterprise Linux AI (RHEL AI) 3) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-85086 thrift: thrift: Information disclosure via improper certificate validation in Perl bindings [epel-all]
bugzilla·2026-10-22·CVSS 6.9
CVE-2026-85086 [MEDIUM] CVE-2026-85086 thrift: thrift: Information disclosure via improper certificate validation in Perl bindings [epel-all]
CVE-2026-85086 thrift: thrift: Information disclosure via improper certificate validation in Perl bindings [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Bugzilla
CVE-2026-85086 thrift: thrift: Information disclosure via improper certificate validation in Perl bindings [fedora-all]
bugzilla·2026-10-22·CVSS 6.9
CVE-2026-85086 [MEDIUM] CVE-2026-85086 thrift: thrift: Information disclosure via improper certificate validation in Perl bindings [fedora-all]
CVE-2026-85086 thrift: thrift: Information disclosure via improper certificate validation in Perl bindings [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Bugzilla
CVE-2026-85086 thrift: thrift: Information disclosure via improper certificate validation in Perl bindings
bugzilla·2026-10-02·CVSS 6.9
CVE-2026-85086 [MEDIUM] CVE-2026-85086 thrift: thrift: Information disclosure via improper certificate validation in Perl bindings
CVE-2026-85086 thrift: thrift: Information disclosure via improper certificate validation in Perl bindings
Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
2026-10-02
Published