GitHub Advisoryadvisory · PyPI

GHSA-hwrj-9rr4-24xh Apache Thrift Python bindings have a Improper Validation of Certificate with Host Mismatch vulnerabilit

MEDIUM Published 2026-07-27 Modified 2026-09-02 Official page ↗
Aliases
CVE-2026-66053
Ecosystem
PyPI
Packages
thrift
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-297
Reviewed
2026-09-02

Affected packages

• PyPI thrift: < 0.24.0 → fixed in 0.24.0

Description

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603

Related

Alias · CVE (1)

  • CVE-2026-66053 Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. vulnerability

Weakness · CWE (1)

  • CWE-297 Improper Validation of Certificate with Host Mismatch weakness

References