CVE-2026-43870Disclosure(apache / thrift)

LOWCVSS 7.3 · HIGH

Signal is active with 4 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

apache CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-22CWE-113CWE-346CWE-400

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

thrift

Threat summary

4 mentions across 1 observed day

What's happening

Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 2 classified signals
4 total mentions across 1 day

Affected systems

Vendors

apache

Products

thrift

Deep dive

Activity timeline4 mentions / 1d

Signal classification2 categories

Disclosure

250.0%

General

250.0%

Referenced assets6 URLs

By indicator

Full discourse4 posts

Open Source Security mailing list@oss_security157d
Disclosure
Apache Thrift CVE-2026-43868: Rust implementation vulnerable to CVE-2020-13949 https://www.openwall.com/lists/oss-security/2026/05/05/2 CVE-2026-43869: TSSLTransportFactory.⁠java hostname verification https://www.openwall.com/lists/oss-security/2026/05/05/3 CVE-2026-43870: Node.js web_server.js multi-vulnerability https://www.openwall.com/lists/oss-security/2026/05/05/4
Post summary
The passage lists three recent Apache Thrift CVEs with brief summaries and links to Openwall mailing‑list discussions, but does not provide PoC, exploit code, active exploitation evidence, or patch information.
02052471
4.7K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds156d
General
CVE-2026-43870 CVE-2026-43870 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-43870
Post summary
The post merely references CVE-2026-43870 and provides a link to additional details, without any substantive information.
0000044
4.0K followersView on X
Infoflowcloud@infoflowcloud156d
General
🚨*CVE* CVE-2026-43870 Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('H… https://www.cve.org/CVERecord?id=CVE-2026-43870 ----- Traducción: CVE-2026-43870 ERR… http://infoflow.cloud`
Post summary
The tweet merely references CVE-2026-43870 and lists its broad vulnerability types without providing PoC, exploit details, patch information, or evidence of active exploitation.
0000029
75 followersView on X
CVE@CVEnew156d
Disclosure
CVE-2026-43870 Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('H… https://www.cve.org/CVERecord?id=CVE-2026-43870
Post summary
The text cites CVE‑2026‑43870, describing an origin validation error with path traversal and CRLF injection issues and links to the CVE record, but offers no evidence of exploitation, PoC, patches, or false positives.
00000162
57.4K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	thrift	-	-	-

Explore more

Back to dashboard apache CVEs thrift vulnerabilities

What researchers are saying

CVE-2026-43870

Open Source Security mailing list@oss_securityDisclosure

The passage lists three recent Apache Thrift CVEs with brief summaries and links to Openwall mailing‑list discussions, but does not provide PoC, exploit code, active exploitation evidence, or patch information.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The post merely references CVE-2026-43870 and provides a link to additional details, without any substantive information.

Infoflowcloud@infoflowcloudGeneral

The tweet merely references CVE-2026-43870 and lists its broad vulnerability types without providing PoC, exploit details, patch information, or evidence of active exploitation.

CVE@CVEnewDisclosure

The text cites CVE‑2026‑43870, describing an origin validation error with path traversal and CRLF injection issues and links to the CVE record, but offers no evidence of exploitation, PoC, patches, or false positives.