Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-27T10:59:46 apache-thrift: Apache Thrift: Information disclosure due to improper certificate validation 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-297

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

A flaw was found in Apache Thrift C++ bindings. This vulnerability, caused by improper validation of certificates with host mismatch, could allow a remote attacker to disclose sensitive information.

This vulnerability strictly impacts Confidentiality with zero effect on Integrity or Availability (C:H, I:N, A:N). Exploitation allows a remote attacker to conduct a man-in-the-middle (MitM) attack and intercept sensitive data transmitted over TLS if hostname validation fails. Red Hat rates this flaw with High Attack Complexity (AC:H) in contrast to NVD's Low Attack Complexity because successful exploitation requires specific, non-default network positioning to intercept traffic alongside a valid TLS certificate that triggers the host mismatch condition. Applications that do not use Apache Thrift C++ bindings for SSL/TLS encrypted client connections, or those operating exclusively over trusted private networks, are unaffected. To mitigate this issue, restrict network access to systems utilizing Apache Thrift C++ bindings for SSL/TLS encrypted client connections to trusted private networks only. If feasible, avoid using Apache Thrift C++ bindings for SSL/TLS encrypted client connections in environments where man-in-the-middle attacks are a concern. Red Hat Enterprise Linux AI (RHEL AI) 3 Affected thrift https://www.cve.org/CVERecord?id=CVE-2026-48145 https://nvd.nist.gov/vuln/detail/CVE-2026-48145 http://www.openwall.com/lists/oss-security/2026/07/24/36 https://lists.apache.org/thread/2popgc4ks1l87jjho1w5fpk5k4x06b7h https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9