CVE-2026-58662 HIGH

CVE-2026-58662: Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass

Vendor Apache Software Foundation

Product Apache Thrift

Weakness CWE-1284

Published July 27, 2026

Last update July 27, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Key dates

02Disclosure timeline

July 27, 2026 CVE published

July 27, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-58662 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1284.html AskarLabs — CWE-1284 write-up Improper Validation of Specified Quantity in Input

Related vulnerabilities

04Related CVE

CVE-2026-27384 WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability CVE-2024-24715 WordPress WordPress BookIt Plugin plugin <= 2.4.0 - Price Bypass Vulnerability vulnerability CVE-2024-30516 WordPress Booking Package plugin <= 1.6.27 - Price Manipulation vulnerability CVE-2026-42732 WordPress Ads by WPQuads plugin <= 3.0.2 - Broken Authentication vulnerability CVE-2025-58835 WordPress Bonus for Woo plugin <= 7.6.6 - Other vulnerability Type vulnerability