← back
CVE-2026-43869highCWE-295CWE-297

Apache Thrift: TSSLTransportFactory.java hostname verification

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3epss 0.6%
exploitation probability
0.6%top 53% of all CVEs
observed exploitation
nono source reports it
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
Apache Software Foundation · Apache Thrift
References
https://access.redhat.com/errata/RHSA-2026:21769https://access.redhat.com/errata/RHSA-2026:22347https://access.redhat.com/errata/RHSA-2026:22423https://access.redhat.com/errata/RHSA-2026:23345https://access.redhat.com/errata/RHSA-2026:24503https://access.redhat.com/errata/RHSA-2026:24539https://access.redhat.com/errata/RHSA-2026:25273https://access.redhat.com/errata/RHSA-2026:26586https://access.redhat.com/errata/RHSA-2026:27126https://access.redhat.com/errata/RHSA-2026:28010https://access.redhat.com/errata/RHSA-2026:30651https://access.redhat.com/errata/RHSA-2026:36882