> CVE-2026-43870

« BACK_TO_HOME
PUBLISHED
2026-05-05 09:16
MODIFIED
2026-05-05 09:16
EPSS (Prob. Exploit)
0.38%
Top 68.0%
DATA SOURCES:
NVD 🔗 2026-05-05 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-10-29 OSV 🔗 2026-11-02 MSRC 🔗 2026-11-02

> DESCRIPTION

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-22 CWE-113 CWE-346 CWE-400

> CWE DETAILED DESCRIPTIONS

CWE-22: Improper Limitation of a Pathname to a Restricted Directory - The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. | CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers - The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers. | CWE-346: Origin Validation Error - The product does not properly verify that the source of data or communication is valid. | CWE-400: Uncontrolled Resource Consumption - The product does not properly control the allocation and maintenance of a limited resource.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update
Red Hat Advanced Cluster Management for Kubernetes 2.14 General Availability release images, which add new features and enhancements, bug fixes, and updated container images.
Red Hat Security Advisory: Multicluster Global Hub 1.4.5 security update
Multicluster Global Hub v1.4.5 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a s...
Red Hat Security Advisory: Multicluster Global Hub 1.5.6 security update
Multicluster Global Hub v1.5.6 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a s...
Red Hat Security Advisory: Multicluster Global Hub 1.6.4 security update
Multicluster Global Hub v1.6.4 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a s...
Red Hat Security Advisory: Multicluster Global Hub 1.7.2 security update
Multicluster Global Hub v1.7.2 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a s...
Red Hat Security Advisory: Multicluster Global Hub 1.7.2 security update
Multicluster Global Hub v1.7.2 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a s...
Red Hat Security Advisory: opentelemetry-collector security update
An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Importan...
Red Hat Security Advisory: opentelemetry-collector security update
An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact o...
Red Hat Security Advisory: opentelemetry-collector security update
An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Importa...
Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.11 security update
Red Hat Advanced Cluster Management for Kubernetes v2.13 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated...

> GITHUB SECURITY ADVISORY

GHSA-526f-jxpj-jmg2 HIGH

Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource Consumption

AFFECTED PACKAGES:
NPM / thrift
<= 0.22.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache Thrift: Node.js web_server.js multi-vulnerability

AFFECTED PACKAGES:
Unknown / Unknown
1 versions affected
ALIASES:
BIT-thrift-2026-43870, GHSA-526f-jxpj-jmg2

> HISTORIQUE DES MODIFICATIONS

Première apparition
05/05/2026 09:16
Source: NVD
📊 ENRICHISSEMENT 01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - The product uses external input to construct a pathname that is intended to identify a file or directory that i...
Nouvelle valeur:
CWE-22: Improper Limitation of a Pathname to a Restricted Directory - The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneat...
📊 ENRICHISSEMENT 01/06/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - The product uses external input to construct a pathname that is intended to identify a file or directory that i...
Total des modifications: 2 Dernière mise à jour: 1 week ago

> REFERENCES

https://lists.apache.org/thread/pgtfq44ltc9t63kxcbqmwqzt45pnhqdy
« BACK_TO_HOME