CVE-2026-48144 is a critical flaw (CVSS 9.1) in the c_glib bindings of Apache Thrift. Versions before 0.24.0 improperly validate a certificate when the host name does not match. The Apache advisory says to upgrade to Thrift 0.24.0, which fixes the issue. Only the c_glib language binding is named as affected.
What's affected
The advisory names the Apache Thrift c_glib (glib) language bindings, all versions before 0.24.0. The fixed version is 0.24.0. The record lists no other Thrift language libraries as affected, so a Java or Python Thrift client is not covered by this CVE on the evidence we have.
The flaw is in client code that you compile in, so a system package upgrade only helps if your program links the library dynamically. Statically linked or vendored copies need a rebuild.
How to check if you're exposed
Find out whether anything in your estate uses the C (glib) Thrift library. Look for programs or containers that link libthrift_c_glib, and for vendored Thrift source trees.
thrift -version
pkg-config --modversion thrift_c_glib
ldd /path/to/your/binary | grep -i thrift
The pkg-config name depends on how your distribution packages the library, so treat an empty result as inconclusive. Your build files and SBOM are the more reliable record.
What to do now
- Build a list of services that use the Thrift c_glib bindings, including vendored copies and container images.
- Upgrade to Apache Thrift 0.24.0 or later and rebuild every program that links it.
- Redeploy and confirm the running version, not just the build host.
- Until then, treat any Thrift TLS connection made from c_glib code as unverified, and keep it on trusted network paths.
Why it matters
The weakness class is CWE-297, improper validation of a certificate with host mismatch. A TLS client is supposed to confirm two things: the certificate chains to a trusted authority, and it was issued for the host the client meant to reach. If the second check is missing, someone who can sit on the network path may present a valid certificate for a different name and still be accepted.
The CVSS vector marks confidentiality and integrity as high impact, which fits that picture. The record does not say the issue is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Paste your lockfile or manifest into the free in-browser dependency scan to see whether Apache Thrift is in your tree, including as a transitive dependency. Reachability analysis can then show whether your code calls the affected path, which helps you order the work.
Quick check
Does this affect my Java Thrift services?
The record names only the c_glib bindings. Check the Apache advisory if you rely on another language binding.
Sources
- Apache Thrift advisory via oss-security, 24 July 2026
- Apache mailing list thread (referenced by the CVE record, page did not load for review)
Last reviewed: 19 October 2026.
