Vulnpedia
← All CVEs

CVE-2026-55969

HIGH 8.7 ALL-YEARS

Published 2026-07-27 · Last modified 2026-07-27 · apache · NVD: Analyzed

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

ELEVATED IMPACT

Severe if exploited (CVSS 8.7), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

1.0%chance of exploitation in 30 days · 63rd percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable yes

Impact if exploited

8.7CVSS 4.0 · HIGH · CNA

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Apache Software Foundation Apache

Products Apache Thrift Thrift

Weakness (CWE)

  • CWE-190: Integer Overflow or Wraparound

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References and research data (JSON)

Vendor product assessments

Showing 32 of 2101 vendor product statements; 2069 omitted. Read the full vendor advisory.

  • cryostat/cryostat-storage-rhel9@sha256:5be66a00286e1733b91ea407788843a4123ff8bdcb830ec031bcd41b1e337255_amd64 as a component of Cryostat 4 on RHEL 9 · fixed

    Vendor assessment for this product only.

    pkg:oci/cryostat-storage-rhel9@sha256:5be66a00286e1733b91ea407788843a4123ff8bdcb830ec031bcd41b1e337255?arch=amd64&repository_url=registry.redhat.io/cryostat/cryostat-storage-rhel9&tag=4.2.0-22

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:b7bd3cb92dc58a77f90482bb800c5a8473fd86f471939a987f213211e63e613e_ppc64le as a component of Multicluster Global Hub 1.7.3 · fixed

    Vendor assessment for this product only.

    pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3Ab7bd3cb92dc58a77f90482bb800c5a8473fd86f471939a987f213211e63e613e?arch=ppc64le&repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9&tag=1785442872

    • vendor fix: For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:4009f21302b24b30cefaa86e84e77cf1743d9dfc7b93aae93b9c2082871d62fc_ppc64le as a component of Red Hat AI Inference Server 3.3 · fixed

    Vendor assessment for this product only.

    pkg:oci/vllm-spyre-rhel9@sha256%3A4009f21302b24b30cefaa86e84e77cf1743d9dfc7b93aae93b9c2082871d62fc?arch=ppc64le&repository_url=registry.redhat.io/rhaiis/vllm-spyre-rhel9&tag=1789502493

    • vendor fix: For more information visit https://access.redhat.com/errata/RHSA-2026:68697 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:6df9b91cc8a80eb0300bc78613c6391f93ba2230a71bef076ddf2e9d94d5b76b_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 · fixed

    Vendor assessment for this product only.

    pkg:oci/acm-grafana-rhel9@sha256%3A6df9b91cc8a80eb0300bc78613c6391f93ba2230a71bef076ddf2e9d94d5b76b?arch=ppc64le&repository_url=registry.redhat.io/rhacm2/acm-grafana-rhel9&tag=1788955233

    • vendor fix: Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9@sha256:5adc2b3523d917b05469e78bebe9b0b3d982848035b81feafeaa5bd090efa2bd_amd64 as a component of Red Hat Enterprise Linux AI 3.3 · fixed

    Vendor assessment for this product only.

    pkg:oci/bootc-azure-rocm-rhel9@sha256%3A5adc2b3523d917b05469e78bebe9b0b3d982848035b81feafeaa5bd090efa2bd?arch=amd64&repository_url=registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9&tag=1790850900

    • vendor fix: The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. For details on deploying and configuring RHEL AI, see the Red Hat Enterprise Linux AI documentation at https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_ai/3.3 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:be73cc0fa3c88694e0e2486111fad512608db9938b1d02f0671221943affd891_arm64 as a component of Red Hat OpenShift AI 3.3 · fixed

    Vendor assessment for this product only.

    pkg:oci/base-image-cpu-rhel9@sha256%3Abe73cc0fa3c88694e0e2486111fad512608db9938b1d02f0671221943affd891?arch=arm64&repository_url=registry.redhat.io/rhai/base-image-cpu-rhel9&tag=1789137641

    • vendor fix: For more information visit https://access.redhat.com/errata/RHSA-2026:68708 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:d237f3e4fd48b21d4fc929d4246d777d3f3cb7dc33265f3d679d3c38ae6f1d24_s390x as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/base-image-cpu-rhel9@sha256%3Ad237f3e4fd48b21d4fc929d4246d777d3f3cb7dc33265f3d679d3c38ae6f1d24?arch=s390x&repository_url=registry.redhat.io/rhai/base-image-cpu-rhel9&tag=1788197530

    • vendor fix: For more information visit https://access.redhat.com/errata/RHSA-2026:69929 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhoai/odh-automl-rhel9@sha256:6ce333572ad4524b8d5f3d713f0b0eeb79eee1060c20f8f3244bb09051a4f90a_arm64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-automl-rhel9@sha256%3A6ce333572ad4524b8d5f3d713f0b0eeb79eee1060c20f8f3244bb09051a4f90a?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-automl-rhel9&tag=1791535789

    • vendor fix: For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9@sha256:aa9d828b90312ab56e9b68a70c39255817a9357c17cfcdbc56fe85d726635261_arm64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-trustyai-garak-lls-provider-dsp-rhel9@sha256%3Aaa9d828b90312ab56e9b68a70c39255817a9357c17cfcdbc56fe85d726635261?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9&tag=1791785804

    • vendor fix: For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhai/base-image-tpu-rhel9@sha256:2df8527a738c3183d24f72f33b9460e9f0a173727486b69a718551dd7afc849f_amd64 as a component of Red Hat OpenShift AI 3.5 · fixed

    Vendor assessment for this product only.

    pkg:oci/base-image-tpu-rhel9@sha256%3A2df8527a738c3183d24f72f33b9460e9f0a173727486b69a718551dd7afc849f?arch=amd64&repository_url=registry.redhat.io/rhai/base-image-tpu-rhel9&tag=1788197492

    • vendor fix: For more information visit https://access.redhat.com/errata/RHSA-2026:71394 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.3 · fixed

    Vendor assessment for this product only.

    pkg:oci/tempo-rhel9@sha256%3Afa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba?arch=ppc64le&repository_url=registry.redhat.io/rhosdt/tempo-rhel9&tag=1788356473

    • vendor fix: For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • openshift-sandboxed-containers/osc-podvm-payload-rhel9 as a component of Confidential Compute Attestation · known affected

    Vendor assessment for this product only.

    pkg:oci/osc-podvm-payload-rhel9?repository_url=registry.redhat.io/openshift-sandboxed-containers/osc-podvm-payload-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • rhaii/vllm-cuda-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-cuda-rhel9?repository_url=registry.redhat.io/rhaii/vllm-cuda-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • rhaii/vllm-neuron-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-neuron-rhel9?repository_url=registry.redhat.io/rhaii/vllm-neuron-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • rhaii/vllm-tpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-tpu-rhel9?repository_url=registry.redhat.io/rhaii/vllm-tpu-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • rhaiis/vllm-neuron-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-neuron-rhel9?repository_url=registry.redhat.io/rhaiis/vllm-neuron-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • rhceph/rhceph-6-dashboard-rhel9 as a component of Red Hat Ceph Storage 6 · known affected

    Vendor assessment for this product only.

    pkg:oci/rhceph-6-dashboard-rhel9?repository_url=registry.redhat.io/rhceph/rhceph-6-dashboard-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • rhceph/snmp-notifier-rhel9 as a component of Red Hat Ceph Storage 7 · known affected

    Vendor assessment for this product only.

    pkg:oci/snmp-notifier-rhel9?repository_url=registry.redhat.io/rhceph/snmp-notifier-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • rhceph/snmp-notifier-rhel9 as a component of Red Hat Ceph Storage 8 · known affected

    Vendor assessment for this product only.

    pkg:oci/snmp-notifier-rhel9?repository_url=registry.redhat.io/rhceph/snmp-notifier-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • rhceph/snmp-notifier-rhel10 as a component of Red Hat Ceph Storage 9 · known affected

    Vendor assessment for this product only.

    pkg:oci/snmp-notifier-rhel10?repository_url=registry.redhat.io/rhceph/snmp-notifier-rhel10

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • rhoai/odh-spark-operator-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-spark-operator-rhel9?repository_url=registry.redhat.io/rhoai/odh-spark-operator-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • openshift-update-service/openshift-update-service-rhel8 as a component of Red Hat OpenShift Update Service · known affected

    Vendor assessment for this product only.

    pkg:oci/openshift-update-service-rhel8?repository_url=registry.redhat.io/openshift-update-service/openshift-update-service-rhel8

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • cryostat/cryostat-agent-init-rhel9@sha256:bc47200b2bb00c9cb4f4ae4929d0faca3b7685ba160bafe07f773e8cfe977b6e_arm64 as a component of Cryostat 4 on RHEL 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/cryostat-agent-init-rhel9@sha256:bc47200b2bb00c9cb4f4ae4929d0faca3b7685ba160bafe07f773e8cfe977b6e?arch=arm64&repository_url=registry.redhat.io/cryostat/cryostat-agent-init-rhel9&tag=0.7.0-12

    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9@sha256:4a7ad1c5f460301c77f671316d1d198f1ddc72391bfd4b8938c333eb3836ae04_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/multicluster-operators-subscription-rhel9@sha256%3A4a7ad1c5f460301c77f671316d1d198f1ddc72391bfd4b8938c333eb3836ae04?arch=arm64&repository_url=registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9&tag=1788976330

    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhacm2/thanos-receive-controller-rhel9@sha256:49e4aedae086edc3d005017ee3cff738301219d0e9a4718f1bf1fc3f6d369cda_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/thanos-receive-controller-rhel9@sha256%3A49e4aedae086edc3d005017ee3cff738301219d0e9a4718f1bf1fc3f6d369cda?arch=amd64&repository_url=registry.redhat.io/rhacm2/thanos-receive-controller-rhel9&tag=1788879380

    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhacm2/acm-search-indexer-rhel9@sha256:ab2048d6a47a7186bd5b07f6febca851c71f9389c7319fb9d6b1dd8cef4b8757_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/acm-search-indexer-rhel9@sha256%3Aab2048d6a47a7186bd5b07f6febca851c71f9389c7319fb9d6b1dd8cef4b8757?arch=arm64&repository_url=registry.redhat.io/rhacm2/acm-search-indexer-rhel9&tag=1788867338

    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhacm2/acm-search-indexer-rhel9@sha256:0f64ed08659f4f30afe4e9ba47029928be40e412a3f5920e57bd4849a632e3b3_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/acm-search-indexer-rhel9@sha256%3A0f64ed08659f4f30afe4e9ba47029928be40e412a3f5920e57bd4849a632e3b3?arch=arm64&repository_url=registry.redhat.io/rhacm2/acm-search-indexer-rhel9&tag=1787248491

    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhacm2/multiclusterhub-rhel9@sha256:a270a1b53b01bc7b39da90c3a44c8173651a0825c889286a384854bee3efcea7_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/multiclusterhub-rhel9@sha256%3Aa270a1b53b01bc7b39da90c3a44c8173651a0825c889286a384854bee3efcea7?arch=s390x&repository_url=registry.redhat.io/rhacm2/multiclusterhub-rhel9&tag=1788989234

    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhacm2/multicluster-operators-channel-rhel9@sha256:6a96df12d009e265d864737e8431a708cf4b66415f5177848cb7177e0b52329d_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/multicluster-operators-channel-rhel9@sha256%3A6a96df12d009e265d864737e8431a708cf4b66415f5177848cb7177e0b52329d?arch=s390x&repository_url=registry.redhat.io/rhacm2/multicluster-operators-channel-rhel9&tag=1787242099

    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9@sha256:85c2edc3a3e3ecf7cc97b39a67a83945065ca3990f8c4d7c31fe222de6aae76c_amd64 as a component of Red Hat OpenShift AI 3.3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9@sha256%3A85c2edc3a3e3ecf7cc97b39a67a83945065ca3990f8c4d7c31fe222de6aae76c?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9&tag=1789651398

    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • registry.redhat.io/rhoai/odh-mod-arch-automl-rhel9@sha256:347ed5e1bbb3cf931ae6d418fb5550f4a33a16fd8c0fdc1ed1fb2e3654efb24e_s390x as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-mod-arch-automl-rhel9@sha256%3A347ed5e1bbb3cf931ae6d418fb5550f4a33a16fd8c0fdc1ed1fb2e3654efb24e?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-mod-arch-automl-rhel9&tag=1791861032

    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00
  • rhoso-operators/openstack-operator-bundle as a component of Red Hat OpenStack Platform 18.0 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/openstack-operator-bundle?repository_url=registry.redhat.io/rhoso-operators/openstack-operator-bundle

    Red Hat · CVE-2026-55969 · Updated 2026-10-23T10:52:12+00:00

Known Affected Software Configurations

VendorProductVersion range
ApacheThrift< 0.24.0

All CVSS metrics

  • HIGH 8.7 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • HIGH 8.7 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • HIGH 7.5 v3.1 · NVD Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS