CVE-2026-92834
Description
A flaw was found in Apache Thrift. The C++ WebSocket server mishandles uninitialized resources and returns an incorrect status code when processing requests. Under specific conditions, a remote attacker could exploit this vulnerability to trigger improper application states and compromise system integrity.
Statement
This vulnerability is rated as Moderate severity because exploitation requires specific transport conditions in the Apache Thrift C++ WebSocket server implementation and leads only to limited integrity impact without enabling code execution or denial of service. In default Red Hat deployments, Thrift-based C++ WebSocket servers are not configured or exposed as standard system services. The risk is primarily confined to environments that explicitly deploy custom services utilizing this specific WebSocket transport.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
