CVE-2026-48144: Apache Thrift c_glib TLS Certificate Host Mismatch (CVSS 9.1)

Overview

CVE-2026-48144 is a critical-severity vulnerability (CVSS 9.1) affecting the c_glib language bindings for Apache Thrift, the widely used cross-language RPC framework originally developed at Facebook and now maintained by the Apache Software Foundation. Disclosed on July 24, 2026 by Jens Geyer of the Apache Thrift security team, the flaw involves improper validation of TLS certificates — specifically, the c_glib TLS client fails to verify that the server's certificate hostname matches the intended connection target.

This omission fundamentally breaks the trust model of TLS. A network-positioned attacker can present a certificate issued for an arbitrary domain, and the c_glib client will accept it as valid — silently exposing all traffic to interception.

Technical Details

The c_glib bindings target GLib-based C applications on Linux platforms and provide a TLS transport layer for securing Thrift RPC calls. The vulnerability is rooted in a missing hostname verification step during the TLS handshake. While certificate authenticity (chain-of-trust validation) may be performed, the critical step of comparing the certificate's Subject Alternative Names (SANs) or Common Name (CN) against the requested hostname is absent.

This is classified as CWE-297 (Improper Validation of Certificate with Host Mismatch) — a well-known class of TLS implementation failure. The practical consequence is that any certificate signed by a trusted CA, regardless of the domain it was issued for, will be accepted by the c_glib TLS client. An attacker with a network vantage point (on-path, ARP poisoning, BGP hijack, or in a shared cloud tenant environment) can intercept and decrypt Thrift RPC traffic, including authentication tokens, sensitive business data, and configuration payloads.

Attack Conditions

• Attacker must be positioned between the Thrift client and server (network-adjacent or network-level access)
• Attacker must possess or be able to obtain any TLS certificate signed by a CA trusted by the target system
• No authentication, privileges, or victim interaction required
• Affects all data traversing the Thrift c_glib TLS transport

CVE-2026-48144 was disclosed alongside three other Apache Thrift CVEs as part of a coordinated security release:

• CVE-2026-45112 — Unbounded read in the c_glib transport (DoS)
• CVE-2026-43871 — TCompactProtocol varint byte-count limit bypass
• CVE-2026-41608 — Unbounded zlib decompression in Python THeaderTransport
• CVE-2026-48145 — TLS hostname mismatch in C++ bindings (same class of flaw, also fixed in 0.24.0)

The parallel discovery of CVE-2026-48145 (C++ bindings) alongside CVE-2026-48144 (c_glib bindings) suggests the Thrift security team conducted a systematic audit of TLS handling across all language binding implementations.

Affected Environments

Any deployment using Apache Thrift c_glib bindings with TLS-enabled transport on versions before 0.24.0 is vulnerable. Highest-risk environments include:

• Microservice architectures relying on Thrift for inter-service communication where TLS is assumed to provide authentication
• Services accessible across VLAN boundaries or multi-tenant network segments
• Cloud deployments where co-tenant network access is possible
• Any environment where "TLS is enabled" has been treated as equivalent to "communication is secure"

Remediation

Upgrade to Apache Thrift 0.24.0 immediately. This release introduces proper hostname verification in the c_glib TLS client.

Steps for remediation:

1. Audit all Thrift deployments — identify any services using the c_glib bindings with TLS transport
2. Update the Apache Thrift library to version 0.24.0 or later in all affected services
3. Verify certificate pinning — consider adding certificate pinning for high-sensitivity service-to-service calls as a defense-in-depth measure
4. Review network segmentation — ensure Thrift services are not reachable from untrusted network segments while patching is underway
5. Audit reverse proxy configurations — reverse proxies or service meshes that perform their own TLS termination do not mitigate the library flaw; they simply push the vulnerable code path to a different layer

No workaround short of upgrading the library is considered sufficient for the c_glib TLS path.

References

• NVD Entry — CVE-2026-48144
• Apache Thrift 0.24.0 Release
• Apache Security Advisory (oss-security mailing list)
• CWE-297: Improper Validation of Certificate with Host Mismatch