Log in Start free

Vulnerability · Published Oct 2, 2026 · Assigned by apache

CVE-2026-86536Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript

Medium 6.3

In plain English

A medium-severity prototype pollution in Apache Thrift from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.3%top 77.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12thriftno fix listedDEBIAN-CVE-2026-86536
Debian:13thriftno fix listedDEBIAN-CVE-2026-86536
Debian:14thriftno fix listedDEBIAN-CVE-2026-86536
Ubuntu:22.04:LTSthriftno fix listedUBUNTU-CVE-2026-86536
Ubuntu:24.04:LTSthriftno fix listedUBUNTU-CVE-2026-86536
Ubuntu:26.04:LTSthriftno fix listedUBUNTU-CVE-2026-86536
Ubuntu:26.10thriftno fix listedUBUNTU-CVE-2026-86536

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Thrift 0 – before 0.25.0
Apache Software Foundation Apache Thrift 0 – before 0.25.0
Apache Software Foundation Apache Thrift 0 – before 0.25.0

Weakness: CWE-1321 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References