VYPR
Get started
← All advisories
High severity7.3NVD Advisory· Published May 5, 2026· Updated May 6, 2026

CVE-2026-43869

CVE-2026-43869

Description

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.thrift:libthriftMaven
<= 0.22.0—

Affected products

2
  • Apache/Thriftinferred2 versions
    <0.23.0+ 1 more
    • (no CPE)range: <0.23.0
    • cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*range: <0.23.0

Patches

1
0919c3d55061

Enable TLS hostname verification in TSSLTransportFactory

https://github.com/apache/thriftJens GeyerApr 11, 2026via ghsa
commit
1 file changed · +4 −0
  • lib/java/src/main/java/org/apache/thrift/transport/TSSLTransportFactory.java+4 −0 modified
    @@ -30,6 +30,7 @@
 import java.util.Arrays;
 import javax.net.ssl.KeyManagerFactory;
 import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLParameters;
 import javax.net.ssl.SSLServerSocket;
 import javax.net.ssl.SSLServerSocketFactory;
 import javax.net.ssl.SSLSocket;
@@ -343,6 +344,9 @@ private static TSocket createClient(SSLSocketFactory factory, String host, int p
     try {
       SSLSocket socket = (SSLSocket) factory.createSocket(host, port);
       socket.setSoTimeout(timeout);
+      SSLParameters sslParams = socket.getSSLParameters();
+      sslParams.setEndpointIdentificationAlgorithm("HTTPS");
+      socket.setSSLParameters(sslParams);
       return new TSocket(socket);
     } catch (TTransportException tte) {
       throw tte;

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

1