CVE-2026-43870: Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource Consumption

May 5, 2026 (updated May 8, 2026)

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’), Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’), Uncontrolled Resource Consumption vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

References

github.com/advisories/GHSA-526f-jxpj-jmg2
github.com/apache/thrift/commit/80184ddca4d4f60ac657bd82b2abc47269814f79
github.com/apache/thrift/releases/tag/v0.23.0
lists.apache.org/thread/pgtfq44ltc9t63kxcbqmwqzt45pnhqdy
nvd.nist.gov/vuln/detail/CVE-2026-43870

Code Behaviors & Features

Detect and mitigate CVE-2026-43870 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →