CVE-2026-58023 is a critical flaw (CVSS 9.1) in the Apache Thrift c_glib bindings. A heap out-of-bounds read exists in the transport leftover bytes path in versions before 0.24.0. Upgrade to Apache Thrift 0.24.0, which fixes it, and rebuild software that bundles the library.
What's affected
- Apache Thrift c_glib bindings before 0.24.0.
- Fixed version: 0.24.0.
How to check if you're exposed
If you use c_glib, run pkg-config --modversion thrift_c_glib to read the version. Search your build files and lockfiles for Thrift. Projects that vendor Thrift source need a source level check.
To find this library in your own projects, paste a manifest or lockfile into the free in-browser dependency scan at gold.safeguard.sh/scan. Gold lists known CVEs for the packages it finds, and its reachability analysis helps you separate code that actually calls a vulnerable function from code that only ships it.
What to do now
- Upgrade Apache Thrift to 0.24.0 or later.
- Regenerate and rebuild code that links the c_glib library.
- Redeploy services and images that carry the old library.
- Run a dependency scan to find any remaining copies.
Once the new version is in, run the same dependency or version check again and keep the output with your change record. Lockfiles drift, and a rebuilt image can quietly pull the old version back in, so check the artifact you actually deploy and not only the source tree.
Why it matters
This is CWE-125 (Out-of-bounds Read). Code reads past the end of a heap buffer when handling leftover bytes in the transport layer. Reads like this can leak memory contents or crash the process, which matches the record scoring high confidentiality and availability impact.
The CISA KEV flag is false. The advisory only covers the c_glib bindings, not other language libraries.
Thrift is a code generation framework, so your project may carry generated code as well as the runtime library. Updating the runtime to 0.24.0 is the step the announcement names. If you check generated code into your repository, regenerate it with the matching compiler version so the two stay in step.
Try it yourself
Use this demo to see how a scan surfaces a fixed version you can move to right away.
Click through it at your own pace, or open it full screen.
Quick check
Does this affect Thrift in Java or Python?
The announcement names the c_glib bindings. A different CVE covers the C++ bindings.
Sources
Last reviewed: 19 October 2026.
