CVE-2026-66053CWE-297

Apache Thrift: Python TSSLSocket Hostname Matcher Import

Medium · published July 27, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
20.7
In the wild
Unconfirmed
What it is

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

This replaces CVE-2026-41603

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00292 · 20.7th percentile
Weakness
CWE-297 · Improper Validation of Certificate with Host Mismatch
Published
2026-07-27T11:18Z
EPSS history
Timeline
  • 27 JUL 11:18Z
    Apache Thrift: Python TSSLSocket Hostname Matcher Import
    cvelistv5