https://seclists.org/oss-sec/2026/q3/263: CVE-2026-48144: Apache Thrift: c_glib TLS Client Missing Hostname Verification
Published Jul 24, 2026
·Updated
Affected Software
1 affected component
Apache Thrift<0.24.0
Frequently Asked Questions
1
What is the severity of CVE-2026-48144?
CVE-2026-48144 has a severity level that indicates a high risk due to improper validation of certificate with host mismatch.
2
How do I fix CVE-2026-48144?
The recommended fix for CVE-2026-48144 is to upgrade to Apache Thrift version 0.24.0 or later.
3
What versions are affected by CVE-2026-48144?
CVE-2026-48144 affects all versions of Apache Thrift (glibc language bindings) before version 0.24.0.
4
What is the impact of CVE-2026-48144 on security?
CVE-2026-48144 can lead to man-in-the-middle attacks due to the lack of hostname verification in TLS connections.
5
How can I verify if my version is vulnerable to CVE-2026-48144?
To check if your version is vulnerable to CVE-2026-48144, verify if it is earlier than Apache Thrift version 0.24.0.