CVE-2026-41602
Published: 28 April 2026
Summary
CVE-2026-41602 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Apache Thrift. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-5 (Denial-of-service Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the integer overflow flaw in Apache Thrift TFramedTransport by requiring timely application of the vendor patch to version 0.23.0.
Provides denial-of-service protections such as resource limiting and validation to mitigate availability impacts from exploitation of the Thrift frame handling overflow.
Validates information inputs to Thrift services, preventing malformed frames from triggering the integer overflow or wraparound leading to crashes or exhaustion.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote network exploitation of the integer overflow in the public-facing Thrift service enables T1190; the resulting application crash or resource exhaustion directly maps to T1499.004.
NVD Description
Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Deeper analysisAI
CVE-2026-41602 is an integer overflow or wraparound vulnerability (CWE-190) in the TFramedTransport implementation of Apache Thrift written in the Go language. It affects Apache Thrift versions prior to 0.23.0. The vulnerability was published on 2026-04-28 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its potential for availability disruption.
Attackers can exploit this vulnerability remotely over the network with low complexity, requiring no privileges, authentication, or user interaction. Successful exploitation leads to high-impact denial of service, as the integer overflow in frame handling can cause resource exhaustion or crashes in affected Thrift services using the Go implementation.
Apache advisories recommend upgrading to version 0.23.0, which resolves the issue. Additional details are available in the Apache mailing list announcement at https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql and the oss-security mailing list post at http://www.openwall.com/lists/oss-security/2026/04/28/6.
Details
- CWE(s)