{"id":"GHSA-2f9f-gq7v-9h6m","revision":"1c8b1367c33e4a4b9d9f22b11d445eab","records":[{"revision":"1c8b1367c33e4a4b9d9f22b11d445eab","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-2f9f-gq7v-9h6m","aliases":["BIT-thrift-2026-43868","CVE-2026-43868"],"title":"Apache Thrift has a Memory Allocation with Excessive Size Value Vulnerability","description":"Memory Allocation with Excessive Size Value vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version [0.23.0](https://github.com/apache/thrift/releases/tag/v0.23.0), which fixes the issue.","state":0,"publishedAt":"2026-05-05T09:31:55+00:00","modifiedAt":"2026-09-10T03:50:45.2429833+00:00","affected":[{"ecosystem":"crates.io","name":"thrift","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.23.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-43868","https://github.com/apache/thrift/commit/d5152211af61f850ec393604316804096dd4632e","https://access.redhat.com/errata/RHSA-2026:26586","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/security/cve/CVE-2026-43868","https://bugzilla.redhat.com/show_bug.cgi?id=2466670","https://github.com/apache/thrift","https://lists.apache.org/thread/zj76dtwnbbs1m7z3focf4wd51pqpsmn9","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43868.json"],"sourceUrl":"https://github.com/advisories/GHSA-2f9f-gq7v-9h6m","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2f9f-gq7v-9h6m","identifiers":["GHSA-2f9f-gq7v-9h6m","BIT-thrift-2026-43868","CVE-2026-43868"]},"retained":false,"historicalAffected":[]}],"coverage":[]}