What is GHSA-7pwc-h2j2-rjgj?

GHSA-7pwc-h2j2-rjgj is a security advisory published by GitHub Security Advisories with High severity. Apache Thrift has an Improper Validation of Certificate with Host Mismatch Vulnerability

Which CVE IDs does GHSA-7pwc-h2j2-rjgj cover?

GHSA-7pwc-h2j2-rjgj covers the following CVE IDs: CVE-2026-43869. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7pwc-h2j2-rjgj?

GHSA-7pwc-h2j2-rjgj has a CVSS v3 base score of 7.3, published by GitHub Security Advisories.

Which products are affected by GHSA-7pwc-h2j2-rjgj?

GHSA-7pwc-h2j2-rjgj affects 1 product, including: maven/org.apache.thrift:libthrift:\u003c= 0.22.0.

GHSA-7pwc-h2j2-rjgjHighCVSS 7.3

Apache Thrift has an Improper Validation of Certificate with Host Mismatch Vulnerability

Vendor

GitHub Security Advisories

Published

May 5, 2026

Last Modified

June 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-43869 →

📋 Description

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

🎯 Affected products1

maven/org.apache.thrift:libthrift:<= 0.22.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2026-43869
https://lists.apache.org/thread/3hsgl1b69wzq3ry39scqbv2dhyl3j52r
http://www.openwall.com/lists/oss-security/2026/05/05/3
https://github.com/apache/thrift/commit/0919c3d5506151514e283a63e1fe1ce83e2449d8
https://github.com/apache/thrift/releases/tag/v0.23.0
https://github.com/advisories/GHSA-7pwc-h2j2-rjgj