SUSE alert openSUSE-SU-2026:0275-1 (thrift)
| From: | maintenance@opensuse.org | |
| To: | security-announce@lists.opensuse.org | |
| Subject: | openSUSE-SU-2026:0275-1: important: Security update for thrift | |
| Date: | Tue, 04 Aug 2026 21:05:07 +0200 | |
| Message-ID: | <20260804190507.BA3D5FDC8@maintenance.suse.de> | |
| Archive-link: | Article |
openSUSE Security Update: Security update for thrift ______________________________________________________________________________ Announcement ID: openSUSE-SU-2026:0275-1 Rating: important References: #1263321 #1263322 #1263365 #1263438 #1263492 #1263557 #1272609 #1272645 #1272647 #1272648 #1272649 #1272650 #1272651 #1272652 #1272653 #1272654 #1272655 #1272656 #1272657 #1272658 Cross-References: CVE-2026-41602 CVE-2026-41604 CVE-2026-41605 CVE-2026-41606 CVE-2026-41607 CVE-2026-41608 CVE-2026-41636 CVE-2026-43871 CVE-2026-45112 CVE-2026-48144 CVE-2026-48145 CVE-2026-48586 CVE-2026-49158 CVE-2026-55968 CVE-2026-55969 CVE-2026-55970 CVE-2026-55971 CVE-2026-58023 CVE-2026-58389 CVE-2026-58662 CVSS scores: CVE-2026-41602 (SUSE): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2026-41604 (SUSE): 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVE-2026-41605 (SUSE): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVE-2026-41606 (SUSE): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVE-2026-41607 (SUSE): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N CVE-2026-41636 (SUSE): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected Products: openSUSE Backports SLE-15-SP7 ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: This update for thrift fixes the following issues: - update to 0.24.0 ( boo#1272609, CVE-2026-41608, boo#1272654, CVE-2026-58023, boo#1272655, CVE-2026-55970, boo#1272656, CVE-2026-49158, boo#1272657, CVE-2026-48586, boo#1272658, CVE-2026-48145, boo#1272652, CVE-2026-58389, boo#1272653, CVE-2026-55971, boo#1272645, CVE-2026-48144, boo#1272647, CVE-2026-45112, boo#1272648, CVE-2026-43871, boo#1272649, CVE-2026-55969, boo#1272650, CVE-2026-55968, boo#1272651, CVE-2026-58662, boo#1272609, CVE-2026-41608): * THRIFT-5930 - thrift_server_socket() copies Unix socket paths into sockaddr_un.sun_path without bounds checking * #3585 - limit recursion depth in c_glib thrift_protocol_skip * #3507 - Add peer hostname validation to c_glib TLS client * #3393 - Fix parent class resolution in c_glib generated dispatch_call * THRIFT-3165 - Disable unsafe TLSv1.0 and TLSv1.1 by default * THRIFT-6021 - When C++ client with HTTP transport calls a oneway RPC method, it must not expect a response * THRIFT-6060 - C++ THttpClient does not reopen socket after server sends Connection: close * THRIFT-6073 - Allow injecting external SSL_CTX into C++ SSLContext * #3597 - link UnitTests against libthriftz to resolve THeaderTransport vtable * #3597 - fix off-by-ten header bounds check in readHeaderFormat * #3569 - Add the cpp.ref (&) annotation to the recursive exception in Recursive.thrift * #3519 - Preserve private_optional field order * #3498 - change sprintf to snprintf to eliminate security warnings on OSX * #3506 - Enforce RFC 6125 wildcard placement in TSSLSocket hostname matching * #3508 - Replace memory-safety asserts with unconditional throws in TBufferTransports * #3431 - Remove another boost header from the public API * #3529 - nodejs+compiler: Add opt-in BigInt support for int64 via js:bigint flag * #3461 - Migration *.sln to *.slnx (except c++ libs) * #2957 - Fix PHP cross-test server IPv4 binding * #3372 - Fix JavaScript exception construction implementation (ES6) * #3520 - added thrift-threat-model.md, SECURITY.md and security section to AGENTS.md * THRIFT-6030 - Harden Erlang protocol negative sizes * #3410 - Add byte-count limit to TCompactProtocol varint reader * THRIFT-5214 - go: Implement connection check in TSocket * THRIFT-5969 - Introduce gofmt for Go library * THRIFT-5996 - go: connection check should work for TLS sockets * THRIFT-6011 - Make compiled Go code formatting compatible with gofmt * THRIFT-6012 - Fix inverted regexp.MatchString arguments and precompile patterns in Go validator * THRIFT-6044 - Limit struct read/write recursion depth in Go library * THRIFT-6071 - Validate container size fits int32 range before narrowing conversion in TSimpleJSONProtocol * #3604 - Bound the container element count before the 64-bit size precheck in the Go JSON protocol * #3604 - widen container size precheck to 64-bit in go protocols * #3599 - check wire-supplied size in simple json ReadMapBegin * #3497 - Bump golang.org/x/sys to 0.0.0-20220412211240-33da011f77ad * #3458 - Prevent concurrent calls to socketConn.Close() in Go * #3428 - Fix range check on 32-bit architectures * #3379 - Replace addr with factory in TServerSocket * #3410 - Add byte-count limit to TCompactProtocol varint reader * #3381 - added int range checks * #3618 - Bump jvm from 2.3.21 to 2.4.0 in /lib/kotlin * #3619 - Bump com.diffplug.spotless from 8.5.1 to 8.7.0 in /lib/kotlin * #3605 - enforce stringLengthLimit in TCompactProtocol.readBinary * #3574 - Bump com.diffplug.spotless from 8.4.0 to 8.5.1 in /lib/kotlin * #3572 - Bump org.jetbrains.kotlinx:kotlinx-coroutines-jdk8 in /lib/kotlin * #3452 - Add message byte tracking to consumeBuffer() in Java transports * #3434 - Bump jvm from 2.3.20 to 2.3.21 in /lib/kotlin * #3420 - Fix Java Spotless formatting * #3415 - Connect skip() to TConfiguration recursion limit * #3412 - Use bounded default for maxSkipDepth in TProtocolUtil * #3410 - Add byte-count limit to TCompactProtocol varint reader * #3396 - Enable TLS hostname verification in TNonblockingSSLSocket * #3390 - Enable TLS hostname verification in TSSLTransportFactory * THRIFT-5915 - Python 3.12+ is not supported due to distutils * THRIFT-5923 - UUID support for Python * THRIFT-6024 - Python THeaderTransport and TZlibTransport default max frame/decompressed size should be DEFAULT_MAX_FRAME_SIZE (16384000), not HARD_MAX_FRAME_SIZE (0x3FFFFFFF) * THRIFT-6043 - Harden Python binary protocol negative sizes * THRIFT-6067 - Python: pip install fails on setuptools < 69 due to sys.exit() in setup.py (PEP 517 build backend) * THRIFT-6069 - suggestion for a few python perf improvements * THRIFT-6070 - Publish Python wheel distributions to PyPI * #3410 - Add byte-count limit to TCompactProtocol varint reader * #3413 - Use sslcompat hostname matcher in TSSLSocket * #3411 - Add default recursion depth limit to TProtocol.skip() * #3408 - Add decompressed payload size limit to Python THeaderTransport * #3377 - Optimize Python C extension readStruct for nested structs * #2957 - Fix PHP cross-test server IPv4 binding - update to 0.23.0 (boo#1263557, CVE-2026-41602, boo#1263492, CVE-2026-41604, boo#1263438, CVE-2026-41605, boo#1263365, CVE-2026-41606, boo#1263321, CVE-2026-41607, boo#1263322, CVE-2026-41636): * THRIFT-5877 - Add cpp cross tests * THRIFT-5866 - Dockerfile to support Ubuntu 24.04 LTS (Noble Numbat) * THRIFT-5909 - add Ruby in GitHub workflow * THRIFT-5649 - add go in GitHub workflow / action * THRIFT-5871 - Improve MAX_MESSAGE_SIZE check and friends * THRIFT-5911 - Inconsistent UUID compilation for aliased types * THRIFT-5912 - Assertion failed: `delta > 0`, file ThreadManagerTests.h, line 162 * THRIFT-5880 - C++ TSocket on an IPv6-only system fails if you use a hostname of 127.0.0.1 * THRIFT-3268 - warning: token pasting of ',' and `__VA_ARGS__` is a GNU extension * THRIFT-5887 - build/cmake/ should be prepended (not appended) to CMAKE_MODULE_PATH * THRIFT-5878 - Add UUID support for THeaderProtocol and TProtocolTap * THRIFT-5898 - Unable to build Thrift as a shared library on Windows * THRIFT-5939 - Replace GUID generation with stable UUID algorithm * THRIFT-5876 - Add Delphi WinHTTP client TLS1.3 support * THRIFT-5896 - Race condition in TServerSocket.Addr() method * THRIFT-5925 - UUID implementation in JAVA is not according to the Thrift Specification * THRIFT-5869 - Close the transport after TServerEventHandler deleteContext * THRIFT-5863 - Make TServerTransport able to customize the max message size * THRIFT-5774 - Add remote client's IP address to ServerContext in TServerEventHandler * THRIFT-4280 - Add async nonblocking ssl support in java client * THRIFT-5879 - java and kotlin cross tests fail in the GitHub action * THRIFT-5902 - Add net10 support * THRIFT-5874 - Introduce new type `MESSAGE_SIZE_LIMIT` in TTransportException * THRIFT-5937 - nodejs episodic generation does not handle extending services * THRIFT-5924 - UUID support for nodejs and nodets * THRIFT-4987 - TProtocolException: Bad version in readMessageBegin when using XHR client with C++ server * THRIFT-5924 - UUID support for nodejs and nodets * THRIFT-5935 - Fix deprecated non-canonical casts for PHP 8.5 compatibility * THRIFT-5921 - Ubuntu focal fail to run composer install * THRIFT-5929 - Fix build failure on PHP 8.5 due to removed zend_exception_get_default * THRIFT-5927 - Cannot use reserved language keyword "None" with target language Python * THRIFT-5885 - TBinaryProtocolAccelerated incorrectly deserializes IntEnum to None * THRIFT-5923 - UUID support for Python * THRIFT-5926 - TSaslClientTransport.open() crashes with DIGEST-MD5 due to None initial response * THRIFT-5915 - Python 3.12+ is not supported due to distutils * THRIFT-5892 - PY_SSIZE_T_CLEAN error in some environments * THRIFT-5873 - mTLS broken with python THttpClient * THRIFT-792 - TSocket hides underlying exceptions when open() fails * THRIFT-5888 - declare support for free-threaded CPython in extension modules * THRIFT-5900 - Thrift Cross Test broken in Github (Python 3.14) * THRIFT-5308 - implement ruby seq reply * THRIFT-5910 - Add UUID support in Ruby * THRIFT-5906 - Remove Fixnum references to support modern Ruby versions * THRIFT-5905 - Add base64 and logger as explicit dependencies * THRIFT-5903 - Fixnum is no longer supported since Ruby 3.2 * THRIFT-5687 - Ruby gems deprecation warning: Gem::Specification#has_rdoc= is deprecated with no replacement * THRIFT-4035 - Thrift ruby runtime does not send unique sequence IDs in requests according to the unit tests * THRIFT-1911 - IOError not being caught in socket.rb * THRIFT-4526 - Implement rubocop for ruby in the sca build, once clean into every make * THRIFT-5273 - warning in ruby version >= 2.4 * THRIFT-5918 - Implement header protocol support for Ruby * THRIFT-5559 - Processor can be implemented on handler trait itself * THRIFT-5928 - skip() call on unknown binary field fails deserialization instead of graceful skipping over field * THRIFT-5739 - set_nodelay should be enabled for TTcpChannel - Update to 0.22.0: * ### Build Process - THRIFT-5836 - 0.21.0 fails to build from sources at Arch Linux: No rule to make target 'Thrift5272.thrift', needed by 'gen-cpp/Thrift5272_types.h' - THRIFT-5860 - cmake 3.5 as a minimum version does not work with cmake 4.0.0 * ### C glib - THRIFT-5817 - [C++] Avoid copy of TUuid * ### C++ - THRIFT-5637 - Thrift compiler should be able to output c++ Aggregate types - THRIFT-5667 - Make ThriftConfig.cmake relocatable - THRIFT-5817 - [C++] Avoid copy of TUuid - THRIFT-5821 - Cannot compile against aws-lc libcrypto (openssl replacement from AWS) - THRIFT-5841 - possible init/deinit conflict with manual initialization flag - THRIFT-5853 - Remove oldstyle casts from TBufferTransports and TCompactProtocol - THRIFT-5854 - TCompactProtocol readString checks maxMessageSize at wrong position and off by one - THRIFT-5868 - UUID Support for TCompactProtocol - THRIFT-5865 - Fix TBinayProtocol with list<UUID> * ### Compiler (General) - THRIFT-5823 - Fix illegal uses of exceptions as normal struct type - THRIFT-5835 - Allow exceptions to be used as regular struct datatype * # Delphi - THRIFT-5822 - Remove deprecated AnsiString functions from the library - THRIFT-5824 - Migrate, refactor and improve Delphi code generation test script - THRIFT-5825 - UUID constants lead to uncompileable Delphi code - THRIFT-5826 - binary constants create uncompilable Delphi code - THRIFT-5827 - enums in typedefs are not resolved in all cases - THRIFT-5837 - Delphi implementation for THRIFT-5835 - THRIFT-5839 - incorrect cast under Win64 - THRIFT-5850 - Switch IThriftConfiguration interface from Cardinal to Integer - THRIFT-5851 - Promote known total stream sizes for seekable stream transports properly - THRIFT-5856 - Client should validate HTTP status * ### Go - THRIFT-5833 - go: Combine I/O and original error in compiler generated Process functions - THRIFT-5845 - The write error for union fields should be TException - THRIFT-5859 - go: Generate a map for know values of an enum type * ### Java - THRIFT-5858 - Introduce new type MESSAGE_SIZE_LIMIT in TTransportException * ### netstd - THRIFT-5832 - Drop net6 support and add net9 instead - THRIFT-5838 - THttpTransport.FlushAsync does not include original exception - THRIFT-5852 - Promote known total stream sizes for seekable stream transports * ### Node.js - THRIFT-5811 - Add ES module support to JS codegen - THRIFT-5848 - Expose InputBufferUnderrunError in nodejs client - THRIFT-5849 - Expose createClient in browser version of nodejs package * ### PHP - THRIFT-1482 - Unix domain socket support under PHP - THRIFT-5829 - PHP lib Use of "static" in callables is deprecated notice * ### Python - THRIFT-5024 - tutorial\py.tornado\PythonServer.py failed under Tornado6 - THRIFT-5847 - Python3.12 deprecation in THttpClient - THRIFT-5857 - Remove deprecated Tornado io_loop usage - THRIFT-5861 - Add isOpen method to TTornadoStreamTransport * ### Swift - THRIFT-4838 - add unix domain socket support to Swift TSocketTransport implementation Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP7: zypper in -t patch openSUSE-2026-275=1 Package List: - openSUSE Backports SLE-15-SP7 (aarch64 i586 ppc64le s390x x86_64): libthrift-0_24_0-0.24.0-bp157.2.3.1 libthrift-devel-0.24.0-bp157.2.3.1 libthrift_c_glib0-0.24.0-bp157.2.3.1 libthriftnb-0_24_0-0.24.0-bp157.2.3.1 libthriftz-0_24_0-0.24.0-bp157.2.3.1 perl-thrift-0.24.0-bp157.2.3.1 python3-thrift-0.24.0-bp157.2.3.1 thrift-0.24.0-bp157.2.3.1 References: https://www.suse.com/security/cve/CVE-2026-41602.html https://www.suse.com/security/cve/CVE-2026-41604.html https://www.suse.com/security/cve/CVE-2026-41605.html https://www.suse.com/security/cve/CVE-2026-41606.html https://www.suse.com/security/cve/CVE-2026-41607.html https://www.suse.com/security/cve/CVE-2026-41608.html https://www.suse.com/security/cve/CVE-2026-41636.html https://www.suse.com/security/cve/CVE-2026-43871.html https://www.suse.com/security/cve/CVE-2026-45112.html https://www.suse.com/security/cve/CVE-2026-48144.html https://www.suse.com/security/cve/CVE-2026-48145.html https://www.suse.com/security/cve/CVE-2026-48586.html https://www.suse.com/security/cve/CVE-2026-49158.html https://www.suse.com/security/cve/CVE-2026-55968.html https://www.suse.com/security/cve/CVE-2026-55969.html https://www.suse.com/security/cve/CVE-2026-55970.html https://www.suse.com/security/cve/CVE-2026-55971.html https://www.suse.com/security/cve/CVE-2026-58023.html https://www.suse.com/security/cve/CVE-2026-58389.html https://www.suse.com/security/cve/CVE-2026-58662.html https://bugzilla.suse.com/1263321 https://bugzilla.suse.com/1263322 https://bugzilla.suse.com/1263365 https://bugzilla.suse.com/1263438 https://bugzilla.suse.com/1263492 https://bugzilla.suse.com/1263557 https://bugzilla.suse.com/1272609 https://bugzilla.suse.com/1272645 https://bugzilla.suse.com/1272647 https://bugzilla.suse.com/1272648 https://bugzilla.suse.com/1272649 https://bugzilla.suse.com/1272650 https://bugzilla.suse.com/1272651 https://bugzilla.suse.com/1272652 https://bugzilla.suse.com/1272653 https://bugzilla.suse.com/1272654 https://bugzilla.suse.com/1272655 https://bugzilla.suse.com/1272656 https://bugzilla.suse.com/1272657 https://bugzilla.suse.com/1272658