CVE-2026-41602: Apache Thrift: Go TFramedTransport uint32 overflow
Apache Thrift: Go TFramedTransport uint32 overflow
Other sources
Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.31.0-20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.15.0-6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.7.5-16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.19.1.kata3-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.15.0.aks0-10 - Upgrade
Upgrade
Apache Thrift (Go) TFramedTransportto a version that resolves this vulnerability.Fixed in 0.23.0Patch CVE-2026-41602
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41602?
CVE-2026-41602 has a severity rating that indicates it is a critical integer overflow vulnerability affecting Apache Thrift.
How do I fix CVE-2026-41602?
To fix CVE-2026-41602, you should upgrade Apache Thrift to version 0.23.0 or later.
What software is affected by CVE-2026-41602?
CVE-2026-41602 affects Apache Thrift versions before 0.23.0.
What is an integer overflow in the context of CVE-2026-41602?
An integer overflow in CVE-2026-41602 refers to a situation where a computation results in a value that exceeds the maximum limit of an unsigned 32-bit integer, leading to potential vulnerabilities.
Can CVE-2026-41602 impact my application?
Yes, if your application uses the affected versions of Apache Thrift, it can be exploited due to the integer overflow vulnerability.