CVE-2026-58662 is a critical flaw (CVSS 9.1) in the Apache Thrift C++ bindings. THeaderTransport::readString() does not bound the info header length properly, causing an out-of-bounds read in versions before 0.24.0. Upgrade to 0.24.0 and rebuild any software that uses the library.
What's affected
- Apache Thrift C++ bindings before 0.24.0.
- Fixed version: 0.24.0.
How to check if you're exposed
Run pkg-config --modversion thrift or thrift -version to read the version. Search lockfiles, build files and vendored source for Thrift. Statically linked binaries need a rebuild, so check the build inputs and not just the host.
To find this library in your own projects, paste a manifest or lockfile into the free in-browser dependency scan at gold.safeguard.sh/scan. Gold lists known CVEs for the packages it finds, and its reachability analysis helps you separate code that actually calls a vulnerable function from code that only ships it.
What to do now
- Upgrade Apache Thrift to 0.24.0 or later.
- Rebuild and redeploy C++ services that link it.
- Check images and vendored copies for older versions.
- Rescan after the rollout.
Once the new version is in, run the same dependency or version check again and keep the output with your change record. Lockfiles drift, and a rebuilt image can quietly pull the old version back in, so check the artifact you actually deploy and not only the source tree.
Why it matters
The record lists CWE-125 (Out-of-bounds Read) and CWE-1284 (Improper Validation of Specified Quantity in Input). A length value read from input is not checked against what the buffer holds. Reading past the buffer can leak data or crash the service, in line with the high confidentiality and availability impact in the record.
The announcement credits the finder. The CISA KEV flag is false.
Thrift headers carry key and value strings in a compact binary form, and parsing them means trusting a length field. The announcement names the function and the missing bound on that length. The same pattern appears across serialization libraries, which is why updating to a maintained release is better than attempting to filter traffic.
Quick check
Is this the same as CVE-2026-58023?
No. That one is in the c_glib bindings. Both are fixed in 0.24.0.
Sources
Last reviewed: 19 October 2026.
