high 7.5

CVE-2026-41636 json

Apache Thrift: Node.js skip() recursion

published 2026-04-28 6 mo ago modified 2026-10-31 8 d ago also BIT-thrift-2026-41636 , EUVD-2026-26026 , GHSA-r67j-r569-jrwp

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 39%
public exploits: 0; none known

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Patch / fix

fixed in 3 distros 5 links 1

npm thrift 0.23.0
bitnami thrift 0.23.0
Apache Software Foundation Apache Thrift 0.23.0

debian suse opensuse alpine azure linux

thrift Debian 14 0.23.0-3

debian advisories DEBIAN-CVE-2026-41636

terraform-provider-susepubliccloud SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 0.0.1-150100.3.14.1
terraform-provider-aws SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.11.0-150200.6.18.1
terraform-provider-tls SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.5.15.1
terraform-provider-helm SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.9.0-150200.6.23.1
terraform-provider-null SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.6.18.1
terraform-provider-local SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.0.0-150200.6.17.1
terraform-provider-google SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.43.0-150200.6.12.1
terraform-provider-random SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.6.15.1

suse advisories SUSE-SU-2026:3057-1 SUSE-SU-2026:3056-1

thrift openSUSE Tumbleweed 0.23.0-1.1

opensuse advisories openSUSE-SU-2026:10685-1

thrift Alpine 3.24 0.23.0-r0

alpine advisories ALPINE-CVE-2026-41636

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

thrift Azure Linux 3.0 0.15.0-6

azure linux advisories AZL-85035

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-41636 updated 2026-10-30 cvss 7.5

apache.com/apache/thrift: Apache Thrift: Node.js skip() recursion

Red Hat AI Inference Server rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, rhaiis/vllm-cuda-rhel9, rhaiis/vllm-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-aws-cuda-rhel9, rhelai3/bootc-gcp-cuda-rhel9, rhelai3/bootc-azure-cuda-rhel9, rhelai3/bootc-azure-rocm-rhel9
affected: no fix planned “Will not fix”
Red Hat OpenShift Container Platform 4 openshift4/ztp-site-generate-rhel8
affected: no fix available
Red Hat OpenShift distributed tracing 3 rhosdt/tempo-rhel9, rhosdt/tempo-query-rhel9, rhosdt/tempo-jaeger-query-rhel9 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9
affected: no fix planned “Will not fix”
Red Hat Multicluster Global Hub 1.3.4 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1779212259
fixed: vendor fix RHSA-2026:22423
Red Hat Multicluster Global Hub 1.4.9 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1779579439
fixed: vendor fix RHSA-2026:22347
Red Hat Multicluster Global Hub 1.5.8 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1778867753
fixed: vendor fix RHSA-2026:21769
Red Hat Multicluster Global Hub 1.6.6 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1780167118
fixed: vendor fix RHSA-2026:23345
Red Hat Advanced Cluster Management for Kubernetes 2.15 rhacm2/acm-grafana-rhel9 1780677003
fixed: vendor fix RHSA-2026:24539

show 3 more

Red Hat Multicluster Global Hub 1.3.4 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1779210675, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1779210608, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779209992, multicluster-globalhub/multicluster-globalhub-operator-bundle 1779925031, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779924243 Red Hat Multicluster Global Hub 1.4.9 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1779838819, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1779839447, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779887217, multicluster-globalhub/multicluster-globalhub-operator-bundle 1779891163, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779147132 Red Hat Multicluster Global Hub 1.5.8 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1779828691, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1779828813, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779828536, multicluster-globalhub/multicluster-globalhub-operator-bundle 1779837290, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779835152 Red Hat Multicluster Global Hub 1.6.6 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1780320809, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1780321673, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779839087, multicluster-globalhub/multicluster-globalhub-operator-bundle 1780370487, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779839762 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/istio-rhel8-operator Red Hat Advanced Cluster Management for Kubernetes 2.15 rhacm2/thanos-rhel9 1780908155, rhacm2/acm-cli-rhel9 1780415683, rhacm2/console-rhel9 1780876734, rhacm2/prometheus-rhel9 1780906025, rhacm2/acm-search-v2-rhel9 1780877544, rhacm2/node-exporter-rhel9 1780876985, +39 more
not affected: vulnerable code not present
Red Hat OpenShift AI (RHOAI) rhoai/odh-model-registry-rhel9, rhoai/odh-notebook-controller-rhel8, rhoai/odh-kf-notebook-controller-rhel8
not affected: vulnerable code not in execute path
Red Hat OpenShift Container Platform 4 openshift4/oc-mirror-plugin-rhel9 Red Hat OpenShift distributed tracing 3 rhosdt/opentelemetry-collector-rhel9
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 6 mo ago (2026-04-28)

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	thrift	<0.23.0	0.23.0
bitnami	thrift	<0.23.0	0.23.0

Affected products

Apache Software Foundation Apache Thrift

Classification

Weakness

CWE-674 Uncontrolled Recursion

References

lists.apache.org /thread/lb4j0zyd5f3g36cos0wql925przpnwql
vendor-advisory, web, mailing-list, patch, release-notes
openwall.com /lists/oss-security/2026/04/28/1
web, mailing-list, discussion
nvd.nist.gov /vuln/detail/CVE-2026-41636
advisory, web
github.com /apache/thrift
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary