CVE-2026-66053

Published: Jul 27, 2026Modified: Jul 27, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: security@apache.org (Secondary)

Description

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603

Affected (1)

Products: Apache: Thrift

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Thrift	Before 0.24.0

Related CWEs

Improper Validation of Certificate with Host Mismatch

The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

References (2)

https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9

Source: security@apache.org

Release Notes

https://lists.apache.org/thread/w4k5dnv1x58knwlhpo9x0or5xh220y65

Source: security@apache.org

Vendor Advisory

Timeline

No history available yet.