openSUSE Security Update: Security update for thrift
______________________________________________________________________________
Announcement ID: openSUSE-SU-2026:0275-1
Rating: important
References: #1263321 #1263322 #1263365 #1263438 #1263492
#1263557 #1272609 #1272645 #1272647 #1272648
#1272649 #1272650 #1272651 #1272652 #1272653
#1272654 #1272655 #1272656 #1272657 #1272658
Cross-References: CVE-2026-41602 CVE-2026-41604 CVE-2026-41605
CVE-2026-41606 CVE-2026-41607 CVE-2026-41608
CVE-2026-41636 CVE-2026-43871 CVE-2026-45112
CVE-2026-48144 CVE-2026-48145 CVE-2026-48586
CVE-2026-49158 CVE-2026-55968 CVE-2026-55969
CVE-2026-55970 CVE-2026-55971 CVE-2026-58023
CVE-2026-58389 CVE-2026-58662
CVSS scores:
CVE-2026-41602 (SUSE): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVE-2026-41604 (SUSE): 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
CVE-2026-41605 (SUSE): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVE-2026-41606 (SUSE): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVE-2026-41607 (SUSE): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
CVE-2026-41636 (SUSE): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products:
openSUSE Backports SLE-15-SP7
______________________________________________________________________________
An update that fixes 20 vulnerabilities is now available.
Description:
This update for thrift fixes the following issues:
- update to 0.24.0 ( boo#1272609, CVE-2026-41608, boo#1272654,
CVE-2026-58023, boo#1272655, CVE-2026-55970, boo#1272656,
CVE-2026-49158, boo#1272657, CVE-2026-48586, boo#1272658,
CVE-2026-48145, boo#1272652, CVE-2026-58389, boo#1272653,
CVE-2026-55971, boo#1272645, CVE-2026-48144, boo#1272647,
CVE-2026-45112, boo#1272648, CVE-2026-43871, boo#1272649,
CVE-2026-55969, boo#1272650, CVE-2026-55968, boo#1272651,
CVE-2026-58662, boo#1272609, CVE-2026-41608):
* THRIFT-5930 - thrift_server_socket() copies Unix socket paths into
sockaddr_un.sun_path without bounds checking
* #3585 - limit recursion depth in c_glib thrift_protocol_skip
* #3507 - Add peer hostname validation to c_glib TLS client
* #3393 - Fix parent class resolution in c_glib generated dispatch_call
* THRIFT-3165 - Disable unsafe TLSv1.0 and TLSv1.1 by default
* THRIFT-6021 - When C++ client with HTTP transport calls a
oneway RPC method, it must not expect a response
* THRIFT-6060 - C++ THttpClient does not reopen socket after server
sends Connection: close
* THRIFT-6073 - Allow injecting external SSL_CTX into C++ SSLContext
* #3597 - link UnitTests against libthriftz to resolve THeaderTransport
vtable
* #3597 - fix off-by-ten header bounds check in readHeaderFormat
* #3569 - Add the cpp.ref (&) annotation to the recursive exception in
Recursive.thrift
* #3519 - Preserve private_optional field order
* #3498 - change sprintf to snprintf to eliminate security warnings on
OSX
* #3506 - Enforce RFC 6125 wildcard placement in TSSLSocket hostname
matching
* #3508 - Replace memory-safety asserts with unconditional throws in
TBufferTransports
* #3431 - Remove another boost header from the public API
* #3529 - nodejs+compiler: Add opt-in BigInt support for int64 via
js:bigint flag
* #3461 - Migration *.sln to *.slnx (except c++ libs)
* #2957 - Fix PHP cross-test server IPv4 binding
* #3372 - Fix JavaScript exception construction implementation (ES6)
* #3520 - added thrift-threat-model.md, SECURITY.md and security section
to AGENTS.md
* THRIFT-6030 - Harden Erlang protocol negative sizes
* #3410 - Add byte-count limit to TCompactProtocol varint reader
* THRIFT-5214 - go: Implement connection check in TSocket
* THRIFT-5969 - Introduce gofmt for Go library
* THRIFT-5996 - go: connection check should work for TLS sockets
* THRIFT-6011 - Make compiled Go code formatting compatible with gofmt
* THRIFT-6012 - Fix inverted regexp.MatchString arguments and precompile
patterns in Go validator
* THRIFT-6044 - Limit struct read/write recursion depth in Go library
* THRIFT-6071 - Validate container size fits int32 range before
narrowing conversion in TSimpleJSONProtocol
* #3604 - Bound the container element count before the 64-bit size
precheck in the Go JSON protocol
* #3604 - widen container size precheck to 64-bit in go protocols
* #3599 - check wire-supplied size in simple json ReadMapBegin
* #3497 - Bump golang.org/x/sys to 0.0.0-20220412211240-33da011f77ad
* #3458 - Prevent concurrent calls to socketConn.Close() in Go
* #3428 - Fix range check on 32-bit architectures
* #3379 - Replace addr with factory in TServerSocket
* #3410 - Add byte-count limit to TCompactProtocol varint reader
* #3381 - added int range checks
* #3618 - Bump jvm from 2.3.21 to 2.4.0 in /lib/kotlin
* #3619 - Bump com.diffplug.spotless from 8.5.1 to 8.7.0 in /lib/kotlin
* #3605 - enforce stringLengthLimit in TCompactProtocol.readBinary
* #3574 - Bump com.diffplug.spotless from 8.4.0 to 8.5.1 in /lib/kotlin
* #3572 - Bump org.jetbrains.kotlinx:kotlinx-coroutines-jdk8 in
/lib/kotlin
* #3452 - Add message byte tracking to consumeBuffer() in Java transports
* #3434 - Bump jvm from 2.3.20 to 2.3.21 in /lib/kotlin
* #3420 - Fix Java Spotless formatting
* #3415 - Connect skip() to TConfiguration recursion limit
* #3412 - Use bounded default for maxSkipDepth in TProtocolUtil
* #3410 - Add byte-count limit to TCompactProtocol varint reader
* #3396 - Enable TLS hostname verification in TNonblockingSSLSocket
* #3390 - Enable TLS hostname verification in TSSLTransportFactory
* THRIFT-5915 - Python 3.12+ is not supported due to distutils
* THRIFT-5923 - UUID support for Python
* THRIFT-6024 - Python THeaderTransport and TZlibTransport default max
frame/decompressed size should be DEFAULT_MAX_FRAME_SIZE (16384000),
not HARD_MAX_FRAME_SIZE (0x3FFFFFFF)
* THRIFT-6043 - Harden Python binary protocol negative sizes
* THRIFT-6067 - Python: pip install fails on setuptools < 69 due to
sys.exit() in setup.py (PEP 517 build backend)
* THRIFT-6069 - suggestion for a few python perf improvements
* THRIFT-6070 - Publish Python wheel distributions to PyPI
* #3410 - Add byte-count limit to TCompactProtocol varint reader
* #3413 - Use sslcompat hostname matcher in TSSLSocket
* #3411 - Add default recursion depth limit to TProtocol.skip()
* #3408 - Add decompressed payload size limit to Python THeaderTransport
* #3377 - Optimize Python C extension readStruct for nested structs
* #2957 - Fix PHP cross-test server IPv4 binding
- update to 0.23.0 (boo#1263557, CVE-2026-41602, boo#1263492,
CVE-2026-41604, boo#1263438, CVE-2026-41605, boo#1263365,
CVE-2026-41606, boo#1263321, CVE-2026-41607, boo#1263322,
CVE-2026-41636):
* THRIFT-5877 - Add cpp cross tests
* THRIFT-5866 - Dockerfile to support Ubuntu 24.04 LTS (Noble Numbat)
* THRIFT-5909 - add Ruby in GitHub workflow
* THRIFT-5649 - add go in GitHub workflow / action
* THRIFT-5871 - Improve MAX_MESSAGE_SIZE check and friends
* THRIFT-5911 - Inconsistent UUID compilation for aliased types
* THRIFT-5912 - Assertion failed: `delta > 0`, file
ThreadManagerTests.h, line 162
* THRIFT-5880 - C++ TSocket on an IPv6-only system fails if you use a
hostname of 127.0.0.1
* THRIFT-3268 - warning: token pasting of ',' and `__VA_ARGS__` is a GNU
extension
* THRIFT-5887 - build/cmake/ should be prepended (not appended) to
CMAKE_MODULE_PATH
* THRIFT-5878 - Add UUID support for THeaderProtocol and TProtocolTap
* THRIFT-5898 - Unable to build Thrift as a shared library on Windows
* THRIFT-5939 - Replace GUID generation with stable UUID algorithm
* THRIFT-5876 - Add Delphi WinHTTP client TLS1.3 support
* THRIFT-5896 - Race condition in TServerSocket.Addr() method
* THRIFT-5925 - UUID implementation in JAVA is not according to the
Thrift Specification
* THRIFT-5869 - Close the transport after TServerEventHandler
deleteContext
* THRIFT-5863 - Make TServerTransport able to customize the max message
size
* THRIFT-5774 - Add remote client's IP address to ServerContext in
TServerEventHandler
* THRIFT-4280 - Add async nonblocking ssl support in java client
* THRIFT-5879 - java and kotlin cross tests fail in the GitHub action
* THRIFT-5902 - Add net10 support
* THRIFT-5874 - Introduce new type `MESSAGE_SIZE_LIMIT` in
TTransportException
* THRIFT-5937 - nodejs episodic generation does not handle extending
services
* THRIFT-5924 - UUID support for nodejs and nodets
* THRIFT-4987 - TProtocolException: Bad version in readMessageBegin when
using XHR client with C++ server
* THRIFT-5924 - UUID support for nodejs and nodets
* THRIFT-5935 - Fix deprecated non-canonical casts for PHP 8.5
compatibility
* THRIFT-5921 - Ubuntu focal fail to run composer install
* THRIFT-5929 - Fix build failure on PHP 8.5 due to removed
zend_exception_get_default
* THRIFT-5927 - Cannot use reserved language keyword "None" with target
language Python
* THRIFT-5885 - TBinaryProtocolAccelerated incorrectly deserializes
IntEnum to None
* THRIFT-5923 - UUID support for Python
* THRIFT-5926 - TSaslClientTransport.open() crashes with DIGEST-MD5 due
to None initial response
* THRIFT-5915 - Python 3.12+ is not supported due to distutils
* THRIFT-5892 - PY_SSIZE_T_CLEAN error in some environments
* THRIFT-5873 - mTLS broken with python THttpClient
* THRIFT-792 - TSocket hides underlying exceptions when open() fails
* THRIFT-5888 - declare support for free-threaded CPython in extension
modules
* THRIFT-5900 - Thrift Cross Test broken in Github (Python 3.14)
* THRIFT-5308 - implement ruby seq replyÂ
* THRIFT-5910 - Add UUID support in Ruby
* THRIFT-5906 - Remove Fixnum references to support modern Ruby versions
* THRIFT-5905 - Add base64 and logger as explicit dependencies
* THRIFT-5903 - Fixnum is no longer supported since Ruby 3.2
* THRIFT-5687 - Ruby gems deprecation warning:
Gem::Specification#has_rdoc= is deprecated with no replacement
* THRIFT-4035 - Thrift ruby runtime does not send unique sequence IDs in
requests according to the unit tests
* THRIFT-1911 - IOError not being caught in socket.rb
* THRIFT-4526 - Implement rubocop for ruby in the sca build,
once clean into every make
* THRIFT-5273 - warning in ruby version >= 2.4
* THRIFT-5918 - Implement header protocol support for Ruby
* THRIFT-5559 - Processor can be implemented on handler trait itself
* THRIFT-5928 - skip() call on unknown binary field fails
deserialization instead of graceful skipping over field
* THRIFT-5739 - set_nodelay should be enabled for TTcpChannel
- Update to 0.22.0:
* ### Build Process
- THRIFT-5836 - 0.21.0 fails to build from sources at Arch Linux: No
rule to make target 'Thrift5272.thrift', needed by
'gen-cpp/Thrift5272_types.h'
- THRIFT-5860 - cmake 3.5 as a minimum version does not work with
cmake 4.0.0
* ### C glib
- THRIFT-5817 - [C++] Avoid copy of TUuid
* ### C++
- THRIFT-5637 - Thrift compiler should be able to output c++ Aggregate
types
- THRIFT-5667 - Make ThriftConfig.cmake relocatable
- THRIFT-5817 - [C++] Avoid copy of TUuid
- THRIFT-5821 - Cannot compile against aws-lc libcrypto (openssl
replacement from AWS)
- THRIFT-5841 - possible init/deinit conflict with manual
initialization flag
- THRIFT-5853 - Remove oldstyle casts from TBufferTransports and
TCompactProtocol
- THRIFT-5854 - TCompactProtocol readString checks maxMessageSize at
wrong position and off by one
- THRIFT-5868 - UUID Support for TCompactProtocol
- THRIFT-5865 - Fix TBinayProtocol with list<UUID>
* ### Compiler (General)
- THRIFT-5823 - Fix illegal uses of exceptions as normal struct type
- THRIFT-5835 - Allow exceptions to be used as regular struct datatype
* # Delphi
- THRIFT-5822 - Remove deprecated AnsiString functions from the library
- THRIFT-5824 - Migrate, refactor and improve Delphi code generation
test script
- THRIFT-5825 - UUID constants lead to uncompileable Delphi code
- THRIFT-5826 - binary constants create uncompilable Delphi code
- THRIFT-5827 - enums in typedefs are not resolved in all cases
- THRIFT-5837 - Delphi implementation for THRIFT-5835
- THRIFT-5839 - incorrect cast under Win64
- THRIFT-5850 - Switch IThriftConfiguration interface from Cardinal to
Integer
- THRIFT-5851 - Promote known total stream sizes for seekable stream
transports properly
- THRIFT-5856 - Client should validate HTTP status
* ### Go
- THRIFT-5833 - go: Combine I/O and original error in compiler
generated Process functions
- THRIFT-5845 - The write error for union fields should be TException
- THRIFT-5859 - go: Generate a map for know values of an enum type
* ### Java
- THRIFT-5858 - Introduce new type MESSAGE_SIZE_LIMIT in
TTransportException
* ### netstd
- THRIFT-5832 - Drop net6 support and add net9 instead
- THRIFT-5838 - THttpTransport.FlushAsync does not include original
exception
- THRIFT-5852 - Promote known total stream sizes for seekable stream
transports
* ### Node.js
- THRIFT-5811 - Add ES module support to JS codegen
- THRIFT-5848 - Expose InputBufferUnderrunError in nodejs client
- THRIFT-5849 - Expose createClient in browser version of nodejs
package
* ### PHP
- THRIFT-1482 - Unix domain socket support under PHP
- THRIFT-5829 - PHP lib Use of "static" in callables is deprecated
notice
* ### Python
- THRIFT-5024 - tutorial\py.tornado\PythonServer.py failed under
Tornado6
- THRIFT-5847 - Python3.12 deprecation in THttpClient
- THRIFT-5857 - Remove deprecated Tornado io_loop usage
- THRIFT-5861 - Add isOpen method to TTornadoStreamTransport
* ### Swift
- THRIFT-4838 - add unix domain socket support to Swift
TSocketTransport implementation
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP7:
zypper in -t patch openSUSE-2026-275=1
Package List:
- openSUSE Backports SLE-15-SP7 (aarch64 i586 ppc64le s390x x86_64):
libthrift-0_24_0-0.24.0-bp157.2.3.1
libthrift-devel-0.24.0-bp157.2.3.1
libthrift_c_glib0-0.24.0-bp157.2.3.1
libthriftnb-0_24_0-0.24.0-bp157.2.3.1
libthriftz-0_24_0-0.24.0-bp157.2.3.1
perl-thrift-0.24.0-bp157.2.3.1
python3-thrift-0.24.0-bp157.2.3.1
thrift-0.24.0-bp157.2.3.1
References:
https://www.suse.com/security/cve/CVE-2026-41602.html
https://www.suse.com/security/cve/CVE-2026-41604.html
https://www.suse.com/security/cve/CVE-2026-41605.html
https://www.suse.com/security/cve/CVE-2026-41606.html
https://www.suse.com/security/cve/CVE-2026-41607.html
https://www.suse.com/security/cve/CVE-2026-41608.html
https://www.suse.com/security/cve/CVE-2026-41636.html
https://www.suse.com/security/cve/CVE-2026-43871.html
https://www.suse.com/security/cve/CVE-2026-45112.html
https://www.suse.com/security/cve/CVE-2026-48144.html
https://www.suse.com/security/cve/CVE-2026-48145.html
https://www.suse.com/security/cve/CVE-2026-48586.html
https://www.suse.com/security/cve/CVE-2026-49158.html
https://www.suse.com/security/cve/CVE-2026-55968.html
https://www.suse.com/security/cve/CVE-2026-55969.html
https://www.suse.com/security/cve/CVE-2026-55970.html
https://www.suse.com/security/cve/CVE-2026-55971.html
https://www.suse.com/security/cve/CVE-2026-58023.html
https://www.suse.com/security/cve/CVE-2026-58389.html
https://www.suse.com/security/cve/CVE-2026-58662.html
https://bugzilla.suse.com/1263321
https://bugzilla.suse.com/1263322
https://bugzilla.suse.com/1263365
https://bugzilla.suse.com/1263438
https://bugzilla.suse.com/1263492
https://bugzilla.suse.com/1263557
https://bugzilla.suse.com/1272609
https://bugzilla.suse.com/1272645
https://bugzilla.suse.com/1272647
https://bugzilla.suse.com/1272648
https://bugzilla.suse.com/1272649
https://bugzilla.suse.com/1272650
https://bugzilla.suse.com/1272651
https://bugzilla.suse.com/1272652
https://bugzilla.suse.com/1272653
https://bugzilla.suse.com/1272654
https://bugzilla.suse.com/1272655
https://bugzilla.suse.com/1272656
https://bugzilla.suse.com/1272657
https://bugzilla.suse.com/1272658
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.