CVE-2026-43869highCWE-295CWE-297

CVE-2026-43869: high-severity vulnerability in Apache Thrift

Apache Thrift: TSSLTransportFactory.java hostname verification

Published · Updated

Follow this CVE+ Monitor Apache Thrift+ Monitor thrift

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3epss 0.6%
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
Apache Software Foundation · Apache Thrift
Related CVEs — Apache Thrift

In the same product, most dangerous first.

CVE-2018-1320—CVE-2018-1320EPSS 8.2%CVE-2016-5397—CVE-2016-5397EPSS 6.9%CVE-2018-11798—CVE-2018-11798EPSS 4.7%CVE-2026-41602HIGHApache Thrift: Go TFramedTransport uint32 overflowEPSS 1.2%CVE-2026-41606MEDIUMApache Thrift: c_glib dispatch stack overflowEPSS 1.1%CVE-2026-58662HIGHApache Thrift: C++ THeaderTransport::readString() info-header length bounds bypassEPSS 1.1%