Skip to content
Fencer Vulns
high 7.3

CVE-2026-43870 json

Apache Thrift: Node.js web_server.js multi-vulnerability

published 2026-05-05 6 mo ago modified 2026-10-26 13 d ago also BIT-thrift-2026-43870 , EUVD-2026-27245 , GHSA-526f-jxpj-jmg2

cvss
7.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 32%
public exploits
0
none known

Summary

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Patch / fix

  • bitnami thrift 0.23.0
  • Apache Software Foundation Apache Thrift 0.23.0
  • thrift Debian 14 0.23.0-3

debian advisories DEBIAN-CVE-2026-43870

  • opentelemetry-collector RHEL 9.6 EUS 0.152.1-1.el9_6
  • opentelemetry-collector RHEL 9.4 E4S 0.152.1-1.el9_4
  • opentelemetry-collector enterprise linux eus 10.0 0.152.1-1.el10_0

red hat advisories RHSA-2026:53415RHSA-2026:53412RHSA-2026:53413

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-43870 updated cvss 8.6

apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities

  • Red Hat Advanced Cluster Management for Kubernetes 2 redhat-user-workloads/crt-redhat-acm-tenant/grafana-acm-213 Red Hat Enterprise Linux 9 opentelemetry-collector Red Hat Enterprise Linux 10 opentelemetry-collector
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4 openshift4/cnf-tests-rhel8, openshift4/ztp-site-generate-rhel8, redhat-user-workloads/telco-5g-tenant/cnf-tests-4-15, redhat-user-workloads/telco-5g-tenant/ztp-site-generate-4-15, redhat-user-workloads/telco-5g-tenant/ztp-site-generate-4-16
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift distributed tracing 3 rhosdt/tempo-rhel9, rhosdt/tempo-query-rhel9, rhosdt/tempo-jaeger-query-rhel9, rhosdt/opentelemetry-collector-rhel9
    affected: workaround, no fix available
  • Red Hat Zero Trust Workload Identity Manager zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9, zero-trust-workload-identity-manager/spiffe-spire-server-rhel9, zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9 Red Hat Zero Trust Workload Identity Manager - Tech Preview zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9, zero-trust-workload-identity-manager/spiffe-spire-server-rhel9, zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Multicluster Global Hub 1.4.9 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1784060681
    fixed: vendor fix RHSA-2026:41030
  • Red Hat Multicluster Global Hub 1.5.8 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1784562060
    fixed: vendor fix RHSA-2026:42852
  • Red Hat Multicluster Global Hub 1.6.6 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1784561376
    fixed: vendor fix RHSA-2026:44622
  • Red Hat Multicluster Global Hub 1.7.4 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1784906628, multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1785442872
    fixed: vendor fix RHSA-2026:47149
show 13 more
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/acm-grafana-rhel9 1787644958
    fixed: vendor fix RHSA-2026:60390
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/acm-grafana-rhel9 1782693386
    fixed: vendor fix RHSA-2026:36882
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) opentelemetry-collector 0.152.1-1.el9_4
    fixed: vendor fix RHSA-2026:53412
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) opentelemetry-collector 0.152.1-1.el10_0
    fixed: vendor fix RHSA-2026:53413
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) opentelemetry-collector 0.152.1-1.el9_6
    fixed: vendor fix RHSA-2026:53415
  • Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9
    not affected: component not present
  • Red Hat Multicluster Global Hub 1.4.9 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1784061472, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1784061010, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1784060515, multicluster-globalhub/multicluster-globalhub-operator-bundle 1784064050, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1784061953 Red Hat Multicluster Global Hub 1.5.8 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1784127491, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1784128029, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1784127524, multicluster-globalhub/multicluster-globalhub-operator-bundle 1784565261, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1784127173 Red Hat Multicluster Global Hub 1.6.6 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1784152046, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1784151884, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1784151772, multicluster-globalhub/multicluster-globalhub-operator-bundle 1784728578, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1784152164 Red Hat Multicluster Global Hub 1.7.4 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1784768332, multicluster-globalhub/multicluster-globalhub-agent-rhel9 1785775948, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1784768150, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1785773056, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1784307548, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1785773214, +3 more Red Hat OpenShift Service Mesh 2 openshift-service-mesh/istio-rhel8-operator Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/thanos-rhel9 1787263906, rhacm2/acm-cli-rhel9 1787259085, rhacm2/console-rhel9 1787339249, rhacm2/prometheus-rhel9 1787263757, rhacm2/acm-search-v2-rhel9 1787682112, rhacm2/node-exporter-rhel9 1787263178, +37 more
    +2 more products
    Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/thanos-rhel9 1783122371, rhacm2/acm-cli-rhel9 1783350872, rhacm2/console-rhel9 1783451729, rhacm2/prometheus-rhel9 1783259161, rhacm2/acm-search-v2-rhel9 1783381100, rhacm2/node-exporter-rhel9 1783327463, +37 more Red Hat AI Inference Server rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9
    not affected: vulnerable code not present
  • Red Hat build of Apache Camel 4 for Quarkus 3 libthrift
    not affected: inline mitigations already exist
  • Red Hat Data Grid 8 libthrift
    not affected: component not present
  • Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more Red Hat Enterprise Linux 10 grafana
    not affected: vulnerable code not present
  • Red Hat Fuse 7 libthrift
    not affected: vulnerable code not in execute path
  • Red Hat JBoss Enterprise Application Platform Expansion Pack libthrift Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel9, rhoai/odh-model-registry-rhel9 Red Hat OpenShift Container Platform 4 openshift4/oc-mirror-plugin-rhel9
    not affected: vulnerable code not present
  • Red Hat OpenStack Platform 18.0 rhoso-operators/openstack-operator-bundle
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
GitHub 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
OSV 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
npm thrift
<=0.22.0
 no fix listed
bitnami thrift
<0.23.0
0.23.0

Affected products

  • Apache Software Foundation Apache Thrift

Classification

Weakness
  • CWE-346 Origin Validation Error
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.