Bug 2507440 (CVE-2026-58023)

Summary: CVE-2026-58023 thrift: Apache Thrift: Information disclosure and denial of service due to out-of-bounds read
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, amctagga, aoconnor, aos-team-art-private, asdas, bbrownin, bniver, dpaolell, flucifre, gmeno, groman, jdelft, jupierce, lgarciaa, mbenjamin, mbiarnes, mhackett, ppalepu, ppostler, prdhamdh, rekumar, sghai, sidsharm, sostapov, suppawar, vereddy, vlaad, vvoronko
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Apache Thrift c_glib bindings. This out-of-bounds read vulnerability allows an attacker to potentially access sensitive information or cause a denial of service. The vulnerability occurs when the software attempts to read data beyond the allocated memory buffer.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2544767, 2544768, 2544769    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-27 12:01:54 UTC 
Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.