CVE-2026-41602
HighAdvisory
Published 28 Apr 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.012
- 65th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 184
- of 17,781 indexed, latest versions
- Container images
- 170
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerability
Carried by container images the latest versions of 184 of 17,781 indexed charts deploy, on 170 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v0.0.0-20151001171628-53dd39833a08, v0.0.0-20161221203622-b2a4d4ae21c7, v0.0.0-20170131211753-2d6060d88206, v0.0.0-20181211084444-2b7365c54f82+13 more | 0.23.0 | 170 |
- OSV records
- GHSA-wf45-q9ch-q8gh
- Also known as
- BIT-thrift-2026-41602
Charts affected
184 by stars
Container images carrying it
170 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| minio/ | 14cea493d9a3 | github.com/ | 0.23.0 | 16 |
| quay.io/ | 1dce27c494a1 | github.com/ | 0.23.0 | 8 |
| grafana/ | 65a578975943 | github.com/ | 0.23.0 | 4 |
| jaegertracing/ | 0214a0ef24b1 | github.com/ | 0.23.0 | 4 |
| jaegertracing/ | 7f1269222903 | github.com/ | 0.23.0 | 4 |
| jaegertracing/ | 049bb0d64ea3 | github.com/ | 0.23.0 | 4 |
| cloudpirates/ | 8dc02a7e5093 | github.com/ | 0.23.0 | 3 |
| dgraph/ | 3b55ea83fffe | github.com/ | 0.23.0 | 3 |
| grafana/ | 0dc5a246ab16 | github.com/ | 0.23.0 | 3 |
| jaegertracing/ | ab6f1a1f0fb4 | github.com/ | 0.23.0 | 3 |
| quay.io/ | 75fb847ac045 | github.com/ | 0.23.0 | 3 |
| grafana/ | 7790f6f7fbd8 | github.com/ | 0.23.0 | 2 |
| grafana/ | f94b1c82957a | github.com/ | 0.23.0 | 2 |
| grafana/ | 079600c9517b | github.com/ | 0.23.0 | 2 |
| grafana/ | 2175aaa91c96 | github.com/ | 0.23.0 | 2 |
| grafana/ | 886b56d5534e | github.com/ | 0.23.0 | 2 |
| grafana/ | 9e1e77ade304 | github.com/ | 0.23.0 | 2 |
| grafana/ | e932bd6ed0e0 | github.com/ | 0.23.0 | 2 |
| grafana/ | f0200a9bff6d | github.com/ | 0.23.0 | 2 |
| hashicorp/ | 6b4e5dadf082 | github.com/ | 0.23.0 | 2 |
| jaegertracing/ | 04d224a9999b | github.com/ | 0.23.0 | 2 |
| otel/ | 7ef2a2ff46b9 | github.com/ | 0.23.0 | 2 |
| otel/ | 32b3c8296dcc | github.com/ | 0.23.0 | 2 |
| temporalio/ | c0a44c26397b | github.com/ | 0.23.0 | 2 |
| ghcr.io/ | 38bfdf5e3774 | github.com/ | 0.23.0 | 2 |
| ghcr.io/ | 78dc63bc5b89 | github.com/ | 0.23.0 | 2 |
| quay.io/ | 6262bc9a2730 | github.com/ | 0.23.0 | 2 |
| quay.io/ | 8e5e9490cd50 | github.com/ | 0.23.0 | 2 |
| quay.io/ | a0a002cb113c | github.com/ | 0.23.0 | 2 |
| amazon/ | d8ab0eef5074 | github.com/ | 0.23.0 | 1 |
| bitnamilegacy/ | 0b60b6565ab2 | github.com/ | 0.23.0 | 1 |
| bitnamilegacy/ | 0f7c8ac484ac | github.com/ | 0.23.0 | 1 |
| bitnamilegacy/ | 5501c419f42e | github.com/ | 0.23.0 | 1 |
| bitnamilegacy/ | 5bb0aa825d16 | github.com/ | 0.23.0 | 1 |
| bitnamilegacy/ | 6dabb4a2088c | github.com/ | 0.23.0 | 1 |
| bitnamilegacy/ | 8935e75fa5d1 | github.com/ | 0.23.0 | 1 |
| bitnamilegacy/ | 952f86d1116c | github.com/ | 0.23.0 | 1 |
| bitnamilegacy/ | ba9f3b4b0b00 | github.com/ | 0.23.0 | 1 |
| bitnamilegacy/ | c0ede65eb88e | github.com/ | 0.23.0 | 1 |
| bitnamilegacy/ | cce234b4381a | github.com/ | 0.23.0 | 1 |
| bitnamilegacy/ | d7cd0e172c4c | github.com/ | 0.23.0 | 1 |
| cockroachdb/ | 983312754620 | github.com/ | 0.23.0 | 1 |
| coredns/ | 73ca82b4ce82 | github.com/ | 0.23.0 | 1 |
| elastic/ | c7a1c63257d0 | github.com/ | 0.23.0 | 1 |
| emqxecp/ | 4c31d9bec846 | github.com/ | 0.23.0 | 1 |
| falcosecurity/ | 1976da721518 | github.com/ | 0.23.0 | 1 |
| falcosecurity/ | 828ee36cb13a | github.com/ | 0.23.0 | 1 |
| fleetdm/ | 12e644b7f40e | github.com/ | 0.23.0 | 1 |
| gomods/ | d714c7ff0231 | github.com/ | 0.23.0 | 1 |
| gomods/ | efb811df7844 | github.com/ | 0.23.0 | 1 |