CVE-2026-41605
Integer Overflow in Apache Thrift Before 0.23.0 Causes Potential Overflow
Publication date: 2026-04-28
Last updated on: 2026-04-28
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | thrift | to 0.23.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-190 | The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-41605 is an integer overflow or wraparound vulnerability in Apache Thrift versions prior to 0.23.0.
Specifically, it affects the Swift Compact Protocol implementation within Apache Thrift, causing incorrect integer handling.
This incorrect handling can lead to unexpected behavior or security risks.
How can this vulnerability impact me? :
The vulnerability can cause incorrect integer handling in Apache Thrift, which may result in unexpected behavior or security risks.
Such issues could potentially be exploited to compromise the security or stability of applications using affected versions of Apache Thrift.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the integer overflow or wraparound vulnerability in Apache Thrift, users are strongly advised to upgrade to Apache Thrift version 0.23.0 or later, where this issue has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the integer overflow vulnerability in Apache Thrift affects compliance with common standards and regulations such as GDPR or HIPAA.