CVE-2026-48145
Undergoing Analysis Undergoing Analysis - In Progress

Host Mismatch Certificate Validation Flaw in Apache Thrift C++

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: Apache Software Foundation

Description
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-48145
EUVD
EUVD-2026-49149

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache thrift to 0.24.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-297 The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48145 is an improper validation of certificate vulnerability in Apache Thrift's C++ bindings. It allows bypassing RFC 6125 wildcard certificate matching rules in the TSSLSocket matchName() function. This means SSL/TLS connections may not properly verify hostnames, potentially accepting invalid certificates.

Detection Guidance

To detect this vulnerability, check the version of Apache Thrift C++ bindings on your system. If it is before 0.24.0, the system is vulnerable. Use commands like 'thrift --version' or inspect package managers (e.g., 'dpkg -l | grep thrift' for Debian/Ubuntu or 'rpm -qa | grep thrift' for RHEL).

Additionally, review SSL/TLS connections using tools like OpenSSL to verify certificate validation behavior. For example, use 'openssl s_client -connect <host>:<port>' to inspect certificates and check for improper host matching.

Impact Analysis

This vulnerability could allow attackers to perform man-in-the-middle attacks by bypassing host verification. Sensitive data transmitted over SSL/TLS connections might be intercepted or altered. Systems using affected Apache Thrift versions before 0.24.0 are at risk.

Compliance Impact

This vulnerability could lead to incorrect host verification during SSL/TLS connections due to improper certificate validation. This may result in unauthorized access to sensitive data, potentially violating compliance requirements under GDPR (data protection) and HIPAA (health information security).

Mitigation Strategies

Upgrade Apache Thrift to version 0.24.0 or later to address the improper certificate validation issue in C++ bindings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48145. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart