CVE-2026-48144

Apache Thrift c_glib bindings before 0.24.0 suffer an improper certificate validation vulnerability allowing attackers to bypass host mismatch checks.

This vulnerability enables man-in-the-middle attacks by allowing attackers to present certificates that do not match the expected host, potentially leading to data interception or unauthorized access. DIB organizations must ensure their Apache Thrift implementations are patched to version 0.24.0 or later to prevent exploitation of this known issue.

Shame score — A critical CVE with a CVSS score of 9.1 that remains unpatched in older versions, representing a negligent failure to maintain secure software configurations.