CVE-2026-66053: Apache Thrift: Python TSSLSocket Hostname Matcher Import
Apache Thrift: Python TSSLSocket Hostname Matcher Import
Other sources
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
This replaces CVE-2026-41603
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.24.0-1 - Upgrade
Upgrade
Apache Thrift (Python bindings)to a version that resolves this vulnerability.Fixed in 0.24.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66053?
CVE-2026-66053 is classified with a high severity due to the potential for a hostname verification bypass in TSSLSocket.
How do I fix CVE-2026-66053?
To fix CVE-2026-66053, update Apache Thrift to the latest version that addresses this vulnerability.
What impact does CVE-2026-66053 have on security?
CVE-2026-66053 can lead to man-in-the-middle attacks by allowing attackers to spoof hostnames.
Which versions of Apache Thrift are affected by CVE-2026-66053?
CVE-2026-66053 affects specific versions of Apache Thrift prior to the patched release that addresses the hostname matcher issue.
Is CVE-2026-66053 related to SSL/TLS security?
Yes, CVE-2026-66053 directly involves the security of SSL/TLS connections in Apache Thrift.