CVE-2026-85087
published 2026-10-02CVE-2026-85087: Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0…
PriorityP335medium6.9CVSS 4.0
AVNACHATPPRNUINVCHVIHVANSCNSINSANEUCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.15%
4.4th percentile
Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| apache_software_foundation | apache_thrift | < 0.25.0 | 0.25.0 |
CVSS provenance
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
thrift: Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op
vendor_redhat·2026-10-02·CVSS 6.9
CVE-2026-85087 [MEDIUM] CWE-295 thrift: Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op
thrift: Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op
Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
A flaw was found in Apache Thrift's Python bindings. Due to improper certificate validation and incorrect status code handling, client applications fail to properly verify the authenticity of a remote server during encrypted connections. A remote attacker in a man-in-the-middle position could exploit this vulnerability to intercept and modify sensitive network communications, resulting in information disclosure and data tampering.
Package: thrift (Red Hat Hardened Images) - Affected
GHSA
Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings.
ghsa_unreviewed·2026-10-02
CVE-2026-85087 [MEDIUM] CWE-295 Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings.
Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
No detection rules found.
No public exploits indexed.
2026-10-02
Published