GHSA-2f9f-gq7v-9h6m

Apache Thrift has a Memory Allocation with Excessive Size Value Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-43868

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	thrift	< 0.23.0	0.23.0

Details

As written in the advisory (Markdown source, shown as plain text).

Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version [0.23.0](https://github.com/apache/thrift/releases/tag/v0.23.0), which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-43868 advisory
https://github.com/apache/thrift/commit/d5152211af61f850ec393604316804096dd4632e web
https://access.redhat.com/errata/RHSA-2026:26586 web
https://access.redhat.com/errata/RHSA-2026:42644 web
https://access.redhat.com/security/cve/CVE-2026-43868 web
https://bugzilla.redhat.com/show_bug.cgi?id=2466670 web
https://github.com/apache/thrift package
https://lists.apache.org/thread/zj76dtwnbbs1m7z3focf4wd51pqpsmn9 web
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43868.json web