{"cvss":7.3,"datePublished":"2026-05-05T09:16:04.340","dateUpdated":"2026-10-26T19:10:00.163","description":"Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","id":"CVE-2026-43870","raw":{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache Thrift","vendor":"Apache Software Foundation","versions":[{"lessThan":"0.23.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*","matchCriteriaId":"0CE7604A-DA43-44E3-9840-9E3696223DD5","versionEndExcluding":"0.23.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue."},{"lang":"es","value":"Error de validación de origen, Limitación inadecuada de un nombre de ruta a un directorio restringido (’salto de ruta’), Neutralización inadecuada de secuencias CRLF en encabezados HTTP (’División de Solicitud/Respuesta HTTP’), vulnerabilidad de Consumo de Recursos No Controlado en Apache Thrift.\n\nEste problema afecta a Apache Thrift: antes de 0.23.0.\n\nSe recomienda a los usuarios actualizar a la versión 0.23.0, que corrige el problema."}],"id":"CVE-2026-43870","lastModified":"2026-10-26T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43870","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-06T13:32:26.695944Z","version":"2.0.3"}}]},"published":"2026-05-05T09:16:04.340","references":[{"source":"security@apache.org","tags":["Vendor Advisory"],"url":"https://lists.apache.org/thread/pgtfq44ltc9t63kxcbqmwqzt45pnhqdy"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/05/05/4"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-113"},{"lang":"en","value":"CWE-346"},{"lang":"en","value":"CWE-400"}],"source":"security@apache.org","type":"Secondary"}]},"severity":"HIGH","source":"nvd","title":"Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neu..."}