CVE-2026-41605
Published: 28 April 2026
Summary
CVE-2026-41605 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Apache Thrift. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identifying, prioritizing, and remediating known software flaws like the integer overflow in Apache Thrift prior to 0.23.0 by applying the vendor-recommended upgrade.
Mandates vulnerability scanning to identify systems running vulnerable versions of Apache Thrift affected by CVE-2026-41605.
Ensures receipt and dissemination of security advisories, such as the Apache announcement for CVE-2026-41605, to initiate flaw remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in network-accessible Apache Thrift RPC framework enables remote exploitation of public-facing applications (T1190) and can be leveraged for limited denial of service via application exploitation (T1499.004).
NVD Description
Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Deeper analysisAI
CVE-2026-41605 is an integer overflow or wraparound vulnerability (CWE-190) in Apache Thrift, affecting all versions prior to 0.23.0. Apache Thrift is a software framework for scalable cross-language services development, commonly used for remote procedure calls (RPC) in distributed systems. The vulnerability was publicly disclosed on April 28, 2026, and carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and low attack complexity.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network. Successful exploitation could result in limited impacts, including partial disclosure of sensitive information, minor modification of data, or limited denial of service, depending on the Thrift implementation and context in which it is deployed.
Apache advisories recommend upgrading to version 0.23.0, which addresses the issue. Detailed discussions are available in the Apache mailing list announcement at https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql and the oss-security mailing list post at http://www.openwall.com/lists/oss-security/2026/04/28/4.
Details
- CWE(s)