CVE-2026-85088
Received Received - Intake

Certificate Validation Bypass in Apache Thrift

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: Apache Software Foundation

Description
Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the host name that was connected to. That comparison walks the subjectAltName dNSName entries first and consults the certificate Common Name afterwards. A name that does not match yields a "skip" result rather than a rejection, so a certificate whose subjectAltName entries are all present and all non-matching falls through to the Common Name, which can then satisfy the check. RFC 6125 section 6.4.4, and RFC 9525 section 2, require that the Common Name is not consulted when a dNSName subjectAltName is present. A certificate carrying subjectAltName entries for one name and a Common Name for another is therefore accepted for a connection to the second name. Exploitation requires an attacker positioned on the network path who holds a certificate that chains to a certificate authority in the client's trust store and whose Common Name matches the connected host name. Public certificate authorities have not issued on Common Name alone for many years, so this is principally a concern for deployments using a private or enterprise public-key infrastructure. This issue affects the C++ library of Apache Thrift from 0.7.0 through 0.24.0 and the D library from 0.9.0 through 0.24.0. Users should upgrade to 0.25.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-85088
EUVD
EUVD-2026-91418

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
apache thrift From 0.7.0 (inc) to 0.24.0 (inc)
apache thrift From 0.9.0 (inc) to 0.24.0 (inc)
apache thrift *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-297 The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper validation of SSL/TLS certificates in Apache Thrift's C++ and D libraries. The default access manager for client sockets checks the peer certificate against the connected hostname but incorrectly skips rejection if subjectAltName entries do not match, falling back to the Common Name. This violates RFC standards which prohibit using Common Name when subjectAltName is present.

Detection Guidance

This vulnerability involves improper certificate validation where the Common Name is checked even when subjectAltName entries are present. Detection requires inspecting TLS/SSL certificates used in Apache Thrift connections. Check if certificates have mismatched subjectAltName entries and Common Names. Use OpenSSL to inspect certificates: openssl s_client -connect <host>:<port> -showcerts. Verify if the certificate's subjectAltName does not include the connected hostname but the Common Name does.

Impact Analysis

An attacker on the network path with a valid certificate can exploit this to bypass certificate validation. This allows man-in-the-middle attacks, enabling interception or modification of data. Impact is higher for private/public key infrastructures where certificates may use Common Name for hostname validation.

Compliance Impact

This vulnerability may violate compliance with standards requiring proper certificate validation, such as GDPR's data protection requirements for secure communications and HIPAA's encryption standards for protected health information. Failure to reject mismatched certificates could lead to unauthorized data exposure or man-in-the-middle attacks, undermining regulatory security controls.

Mitigation Strategies

Upgrade Apache Thrift C++ library to version 0.25.0 or later if using versions 0.7.0 through 0.24.0. Similarly, upgrade the D library to version 0.25.0 or later if using versions 0.9.0 through 0.24.0.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85088. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart