CVE-2026-58023: Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path
Apache Thrift: cglib heap out-of-bounds read in transport leftover-bytes path
Other sources
Out-of-bounds Read vulnerability in Apache Thrift cglib bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.24.0-1 - Upgrade
Upgrade
apache/thriftto a version that resolves this vulnerability.Fixed in 0.24.0 - Compensating control
If upgrading to Apache Thrift 0.24.0 is not immediately possible, reduce exposure by limiting clients/instances that can reach Thrift services until the upgrade is completed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58023?
CVE-2026-58023 has been classified as a high severity vulnerability due to the potential for exploitation leading to out-of-bounds memory access.
How do I fix CVE-2026-58023?
To mitigate CVE-2026-58023, update your Apache Thrift installation to the latest version that addresses this vulnerability.
What systems are affected by CVE-2026-58023?
CVE-2026-58023 affects systems running Apache Thrift with the c_glib transport method that allows for heap out-of-bounds access.
How can I check if my system is vulnerable to CVE-2026-58023?
You can check your system by reviewing the version of Apache Thrift you are running and comparing it to the versions that have addressed CVE-2026-58023.
What are the potential impacts of exploiting CVE-2026-58023?
Exploitation of CVE-2026-58023 could lead to arbitrary code execution, data corruption, and potential denial of service due to memory manipulation.