Bug 2466670 (CVE-2026-43868)

Summary: CVE-2026-43868 Apache Thrift: Apache Thrift: Denial of Service via excessive memory allocation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: alinfoot, anujha, asoldano, bbaranow, bbrownin, bmaxwell, bstansbe, dlofthou, dtrifiro, fmongiar, gmalinko, istudens, ivassile, iweiss, janstey, jkoehler, jnethert, lphiri, mosmerov, msvehla, nwallace, pberan, pdelbell, pesilva, pjindal, pmackay, rbryant, rstancel, rstepani, smaestri, thjenkin, vdosoudi, weaton
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Apache Thrift. This vulnerability involves a Memory Allocation with Excessive Size Value, which could allow an attacker to trigger resource exhaustion. By providing an overly large size value during memory allocation, an attacker can cause the affected system to become unresponsive, leading to a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2484177    
Bug Blocks:    

Description OSIDB Bzimport 2026-05-05 09:01:22 UTC 
Memory Allocation with Excessive Size Value vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Comment 3 errata-xmlrpc 2026-06-17 23:05:28 UTC 
This issue has been addressed in the following products:

  Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1

Via RHSA-2026:26586 https://access.redhat.com/errata/RHSA-2026:26586