CVE-2026-41607
Medium · 6.5CVSS
6.5
EPSS
0.9%
Published
Apr 28, 2026
CISA due date
—
The record
Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | grafana | 0 | 11.6.14+security04-4.1 |
| openSUSE:Tumbleweed | thrift | 0 | 0.23.0-1.1 |
Related vulnerabilities
- CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that… Also affects grafana
- CVE-2026-42506 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
- CVE-2026-25680 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of… Also affects grafana
- CVE-2026-28380 Any Editor could delete any snapshot, even if they have no access to read or write them. Also affects grafana
- CVE-2026-28383 A request to the Grafana plugin resources endpoint can cause unbounded memory allocation… Also affects grafana
- CVE-2026-33378 Using the $__timeGroup macro, one can achieve an OOM by overloading the server. Also affects grafana
- CVE-2026-33380 A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary… Also affects grafana
- CVE-2026-33377 An Editor can overwrite a dashboard not owned by them to acquire admin on that specific… Also affects grafana