StackRadar

CVE-2026-43871

High

Advisory

Published 27 Jul 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
47th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
343
of 17,781 indexed, latest versions
Container images
295
deployed by those charts
Fix available
3 of 3
affected packages

Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop

Carried by container images the latest versions of 343 of 17,781 indexed charts deploy, on 295 images.

Affected packageAffected versionsFixed inImages
github.com/apache/thriftgolangv0.0.0-20151001171628-53dd39833a08, v0.0.0-20161221203622-b2a4d4ae21c7, v0.0.0-20170131211753-2d6060d88206, v0.0.0-20181211084444-2b7365c54f82+15 more0.24.0209
libthriftmaven0.9.0, 0.9.1, 0.9.2, 0.9.3+10 more0.24.062
thriftpypi0.11.0, 0.13.0, 0.15.0, 0.16.0+2 more0.24.025
OSV records
GHSA-8wv5-x4w7-5gww
Also known as
BIT-thrift-2026-43871, PYSEC-2026-3926

Charts affected

343 by stars
ChartLatestAffected imagesRadar Score
miniosergiotocaliniVerified publisher1.0.01 of 1See more

minio sergiotocalini 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-07-21T21-12-44Z8e5e9490cd50
github.com/apache/thrift@v0.18.1
0.24.0

Open the chart page →

4,203
ccx-monitoringseveralnines0.6.211 of 7See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
github.com/apache/thrift@v0.22.0
0.24.0

Open the chart page →

7,708
vault-devsikalabs0.2.01 of 1See more

vault-dev sikalabs 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
hashicorp/vault:latest5520cc26271c
github.com/apache/thrift@v0.23.1-0.20260429145742-d2acd3c49e58
0.24.0

Open the chart page →

224
mimirskyloud-helm-chartsVerified publisher5.5.11 of 5See more

mimir skyloud-helm-charts 5.5.1

1 of the 5 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-09-30T07-02-29Z6262bc9a2730
github.com/apache/thrift@v0.19.0
0.24.0

Open the chart page →

10,651
archivaslamdev0.0.71 of 2See more

archiva slamdev 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
xetusoss/archiva:v2.2.588f25242b9ee
libthrift@0.9.1
0.24.0

Open the chart page →

6,907
kube-prometheus-stacksoftonic81.5.11 of 6See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
grafana/grafana:12.3.2ba93c9d192e5
github.com/apache/thrift@v0.22.0
0.24.0

Open the chart page →

4,974
atlassian-confluencesomeblackmagic3.4.11 of 1See more

atlassian-confluence someblackmagic 3.4.1

1 of the 1 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
atlassian/confluence-server:7.10.03b9222ab32ef
libthrift@0.9.0
0.24.0

Open the chart page →

13,605
servicexssl-hep1.8.51 of 16See more

servicex ssl-hep 1.8.5

1 of the 16 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2022.12.12-debian-11-r90f7c8ac484ac
github.com/apache/thrift@v0.16.0
0.24.0

Open the chart page →

66,266
cost-analyzerstatcan1.82.21 of 9See more

cost-analyzer statcan 1.82.2

1 of the 9 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
grafana/grafana:7.5.609bb407e26ab
github.com/apache/thrift@v0.13.0
0.24.0

Open the chart page →

16,506
fdi-dotstatsuite-sfs-solrstatcan1.0.21 of 4See more

fdi-dotstatsuite-sfs-solr statcan 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
library/solr:8.11.18c5f7881cebb
libthrift@0.14.1
0.24.0

Open the chart page →

6,065
solrstatcan1.5.101 of 3See more

solr statcan 1.5.10

1 of the 3 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
library/solr:8.11.18c5f7881cebb
libthrift@0.14.1
0.24.0

Open the chart page →

8,806
trinostatcan1.23.41 of 2See more

trino statcan 1.23.4

1 of the 2 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
trinodb/trino:405ee80ab5eeab2
libthrift@0.9.3-1
0.24.0

Open the chart page →

13,767
sn-consolestreamnative1.13.01 of 1See more

sn-console streamnative 1.13.0

1 of the 1 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
streamnative/private-cloud-console:v2.3.27-all91e54375e154
libthrift@0.14.2
0.24.0

Open the chart page →

1,827
stunner-prometheusstunner0.2.11 of 4See more

stunner-prometheus stunner 0.2.1

1 of the 4 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/apache/thrift@v0.23.1-0.20260429145742-d2acd3c49e58
0.24.0

Open the chart page →

3,025
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
github.com/apache/thrift@v0.22.0
0.24.0

Open the chart page →

3,460
agentssynapse0.1.301 of 9See more

agents synapse 0.1.30

1 of the 9 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:1.42.07d32a4eddec7
github.com/apache/thrift@v0.17.0
0.24.0

Open the chart page →

7,244
zipkin-gcpt3n1.0.01 of 1See more

zipkin-gcp t3n 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
openzipkin/zipkin-gcp:0.15.2b5d51d1144e2
libthrift@0.12.0
0.24.0

Open the chart page →

4,538
telegraf-ds-k3stelegraf-ds-k3s1.0.01 of 1See more

telegraf-ds-k3s telegraf-ds-k3s 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
library/telegraf:1.19.0-alpine794079a7f241
github.com/apache/thrift@v0.13.0
0.24.0

Open the chart page →

3,764
temporaltemporal0.28.93 of 13See more

temporal temporal 0.28.9

3 of the 13 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
library/cassandra:3.11.3ce85468c5bad
libthrift@0.9.2
0.24.0
temporalio/admin-tools:1.22.0836af062af30
github.com/apache/thrift@v0.18.0
0.24.0
temporalio/server:1.22.0ddeebf8bad8f
github.com/apache/thrift@v0.18.1
0.24.0

Open the chart page →

21,005
the0the0Verified publisher0.9.81 of 9See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
github.com/apache/thrift@v0.21.0
0.24.0

Open the chart page →

7,248
todolist-charttodolist-chart0.1.71 of 10See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/apache/thrift@v0.23.1-0.20260429145742-d2acd3c49e58
0.24.0

Open the chart page →

6,973
synapsetranhailongVerified publisher0.1.01 of 2See more

synapse tranhailong 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.78.0def97fd537d8
thrift@0.15.0
0.24.0

Open the chart page →

3,164
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
grafana/grafana:12.3.070d9599b186c
github.com/apache/thrift@v0.22.0
0.24.0

Open the chart page →

4,526
tyk-control-planetyk-helm5.3.02 of 7See more

tyk-control-plane tyk-helm 5.3.0

2 of the 7 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
tykio/tyk-dashboard:v5.13.10e03b94c153d
github.com/apache/thrift@v0.23.0
0.24.0
tykio/tyk-gateway-ee:v5.13.13e907e675bf9
github.com/apache/thrift@v0.23.0
0.24.0

Open the chart page →

2,925
tyk-dashboardtyk-helm5.3.01 of 1See more

tyk-dashboard tyk-helm 5.3.0

1 of the 1 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
tykio/tyk-dashboard:v5.13.10e03b94c153d
github.com/apache/thrift@v0.23.0
0.24.0

Open the chart page →

653
tyk-data-planetyk-helm5.3.01 of 3See more

tyk-data-plane tyk-helm 5.3.0

1 of the 3 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
tykio/tyk-gateway-ee:v5.13.13e907e675bf9
github.com/apache/thrift@v0.23.0
0.24.0

Open the chart page →

848
tyk-stacktyk-helm5.3.02 of 7See more

tyk-stack tyk-helm 5.3.0

2 of the 7 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
tykio/tyk-dashboard:v5.13.10e03b94c153d
github.com/apache/thrift@v0.23.0
0.24.0
tykio/tyk-gateway-ee:v5.13.13e907e675bf9
github.com/apache/thrift@v0.23.0
0.24.0

Open the chart page →

2,875
miniouninettsigma21.2.01 of 1See more

minio uninettsigma2 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
sigma2as/minio:20240306-3a2e4f5c284ead9ec3e
github.com/apache/thrift@v0.16.0
0.24.0

Open the chart page →

4,960
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
github.com/apache/thrift@v0.21.0
0.24.0

Open the chart page →

45,239
queryservicewbstack0.2.11 of 1See more

queryservice wbstack 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
ghcr.io/wbstack/queryservice:0.3.6_0.6b83b5b81d4b6
libthrift@0.10.0
0.24.0

Open the chart page →

4,649
supersetwbstack0.1.01 of 1See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
apache/superset:4.0.1ab9467fd712c
thrift@0.16.0
0.24.0

Open the chart page →

7,085
drillwearefrank1.3.61 of 3See more

drill wearefrank 1.3.6

1 of the 3 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
apache/drill:1.21.11f96558fd292
libthrift@0.14.0
0.24.0

Open the chart page →

9,397
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:14.0.03029dc0f1d38
libthrift@0.13.0
0.24.0

Open the chart page →

28,605
athens-proxywenerme0.5.22 of 2See more

athens-proxy wenerme 0.5.2

2 of the 2 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
gomods/athens:v0.11.0efb811df7844
github.com/apache/thrift@v0.12.0
0.24.0
jaegertracing/all-in-one:latestab6f1a1f0fb4
github.com/apache/thrift@v0.22.0
0.24.0

Open the chart page →

4,984
cadencewenerme0.23.03 of 5See more

cadence wenerme 0.23.0

3 of the 5 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
library/cassandra:3.11.3ce85468c5bad
libthrift@0.9.2
0.24.0
ubercadence/server:0.23.22ac5491d13bb
github.com/apache/thrift@v0.0.0-20161221203622-b2a4d4ae21c7
0.24.0
ghcr.io/banzaicloud/tcheck:latest0147d87c2019
github.com/apache/thrift@v0.0.0-20170131211753-2d6060d88206
0.24.0

Open the chart page →

10,127
minio-standalonewenerme1.0.21 of 1See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-01-04T07-41-07Z1484c87239ea
github.com/apache/thrift@v0.15.0
0.24.0

Open the chart page →

6,138
temporalwenerme0.15.13 of 13See more

temporal wenerme 0.15.1

3 of the 13 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
library/cassandra:3.11.3ce85468c5bad
libthrift@0.9.2
0.24.0
temporalio/admin-tools:1.15.135034611d981
github.com/apache/thrift@v0.0.0-20161221203622-b2a4d4ae21c7
thrift@0.15.0
0.24.0
0.24.0
temporalio/server:1.15.1e26758f5a1bf
github.com/apache/thrift@v0.0.0-20161221203622-b2a4d4ae21c7
0.24.0

Open the chart page →

22,665
vaultwenerme0.34.11 of 2See more

vault wenerme 0.34.1

1 of the 2 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
hashicorp/vault:2.0.45be49781ecf7
github.com/apache/thrift@v0.23.1-0.20260429145742-d2acd3c49e58
0.24.0

Open the chart page →

542
victoria-metrics-k8s-stackwenerme0.92.11 of 7See more

victoria-metrics-k8s-stack wenerme 0.92.1

1 of the 7 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
grafana/grafana:13.1.17cb8c64c4d57
github.com/apache/thrift@v0.23.1-0.20260429145742-d2acd3c49e58
0.24.0

Open the chart page →

1,889
wexa-studiowexa-studio1.2.04 of 15See more

wexa-studio wexa-studio 1.2.0

4 of the 15 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.40b01ed3924e6
github.com/apache/thrift@v0.16.0
0.24.0
minio/minio:RELEASE.2024-01-16T16-07-38Z4c4a4876193f
github.com/apache/thrift@v0.19.0
0.24.0
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
github.com/apache/thrift@v0.21.0
0.24.0
temporalio/server:1.29.1c1e3326b2ce1
github.com/apache/thrift@v0.21.0
0.24.0

Open the chart page →

14,983
jaegerwikimedia3.1.23 of 4See more

jaeger wikimedia 3.1.2

3 of the 4 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
jaegertracing/jaeger-agent:1.53.00214a0ef24b1
github.com/apache/thrift@v0.19.0
0.24.0
jaegertracing/jaeger-collector:1.53.07f1269222903
github.com/apache/thrift@v0.19.0
0.24.0
jaegertracing/jaeger-query:1.53.0049bb0d64ea3
github.com/apache/thrift@v0.19.0
0.24.0

Open the chart page →

9,248
opentelemetry-collectorwikimedia0.62.71 of 1See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
github.com/apache/thrift@v0.18.1
0.24.0

Open the chart page →

2,022
prometheus-monitoring-stackyotron-helm-charts1.2.01 of 3See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-43871.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
github.com/apache/thrift@v0.23.1-0.20260429145742-d2acd3c49e58
0.24.0

Open the chart page →

878

Container images carrying it

295 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
libthrift@0.16.0
0.24.0
2
quay.io/keycloak/keycloak:17.0.1-legacy68f9f38c8f30
libthrift@0.14.1
0.24.0
2
quay.io/minio/minio:RELEASE.2023-09-30T07-02-29Z6262bc9a2730
github.com/apache/thrift@v0.19.0
0.24.0
2
quay.io/minio/minio:RELEASE.2023-07-21T21-12-44Z8e5e9490cd50
github.com/apache/thrift@v0.18.1
0.24.0
2
quay.io/minio/minio:RELEASE.2023-02-10T18-48-39Za0a002cb113c
github.com/apache/thrift@v0.17.0
0.24.0
2
5200710/hive:3.1.3-postgresql-metastoree34ab066d2ed
libthrift@0.9.3
0.24.0
1
amancevice/superset:0.28.1c8c04bfe3d66
thrift@0.11.0
0.24.0
1
amazon/aws-otel-collector:v0.27.0d8ab0eef5074
github.com/apache/thrift@v0.18.0
0.24.0
1
amazon/cloudwatch-agent:latest-arm649dea6643715a
github.com/apache/thrift@v0.23.0
0.24.0
1
apache/drill:1.21.11f96558fd292
libthrift@0.14.0
0.24.0
1
apache/druid:29.0.10cef139b6bf1
libthrift@0.13.0
0.24.0
1
apache/gravitino-iceberg-rest:1.3.080136ae753ee
libthrift@0.12.0
0.24.0
1
apache/hertzbeat:1.8.075d48a62748f
libthrift@0.14.1
0.24.0
1
apache/iotdb:0.11.28647309f95d1
libthrift@0.13.0
0.24.0
1
apache/iotdb:0.13.3-nodeafa47bf1692a
libthrift@0.14.1
0.24.0
1
apache/ranger:2.7.076c176e8a0e4
libthrift@0.14.0
0.24.0
1
apache/rocketmq:5.3.0434d8398f996
libthrift@0.14.1
0.24.0
1
apache/rocketmq:4.9.35ac2a4e0f627
libthrift@0.14.1
0.24.0
1
apache/skywalking-oap-server:8.9.1b4ec8c18d079
libthrift@0.14.1
0.24.0
1
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
thrift@0.13.0
0.24.0
1
apache/superset:4.0.1ab9467fd712c
thrift@0.16.0
0.24.0
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
thrift@0.22.0
0.24.0
1
assistiot/cybersecurity-monitoring_ir-cas:latest6a107f224c34
libthrift@0.9.2
0.24.0
1
assistiot/identity-manager_kc:latest0df4b4fa899a
libthrift@0.14.1
0.24.0
1
atlassian/confluence-server:7.10.03b9222ab32ef
libthrift@0.9.0
0.24.0
1
bitnamilegacy/minio:2023.12.230b60b6565ab2
github.com/apache/thrift@v0.19.0
0.24.0
1
bitnamilegacy/minio:2022.12.12-debian-11-r90f7c8ac484ac
github.com/apache/thrift@v0.16.0
0.24.0
1
bitnamilegacy/minio:2024.8.3-debian-12-r15501c419f42e
github.com/apache/thrift@v0.20.0
0.24.0
1
bitnamilegacy/minio:2023.12.23-debian-11-r25bb0aa825d16
github.com/apache/thrift@v0.19.0
0.24.0
1
bitnamilegacy/minio:2025.7.23-debian-12-r56dabb4a2088c
github.com/apache/thrift@v0.21.0
0.24.0
1
bitnamilegacy/minio:2025.7.23-debian-12-r08935e75fa5d1
github.com/apache/thrift@v0.21.0
0.24.0
1
bitnamilegacy/minio:2024.7.4-debian-12-r0952f86d1116c
github.com/apache/thrift@v0.20.0
0.24.0
1
bitnamilegacy/minio:2025.3.12-debian-12-r0ba9f3b4b0b00
github.com/apache/thrift@v0.21.0
0.24.0
1
bitnamilegacy/minio:2024.12.18-debian-12-r1c0ede65eb88e
github.com/apache/thrift@v0.21.0
0.24.0
1
bitnamilegacy/minio:2024.12.18-debian-12-r0cce234b4381a
github.com/apache/thrift@v0.21.0
0.24.0
1
bitnamilegacy/minio:2025.4.22-debian-12-r1d7cd0e172c4c
github.com/apache/thrift@v0.21.0
0.24.0
1
bivas/presto:0.19605545994f806
libthrift@0.9.1
0.24.0
1
bytebase/bytebase:latest9fcde38c0d5f
github.com/apache/thrift@v0.23.0
0.24.0
1
checkmk/check-mk-community:2.5.0p6c11b422210c4
github.com/apache/thrift@v0.23.1-0.20260429145742-d2acd3c49e58
0.24.0
1
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
libthrift@0.15.0
0.24.0
1
cleanstart/minio:latest544bdb8811e1
github.com/apache/thrift@v0.23.0
0.24.0
1
cockroachdb/cockroach-operator:v2.1.0983312754620
github.com/apache/thrift@v0.0.0-20181211084444-2b7365c54f82
0.24.0
1
coredns/coredns:1.7.073ca82b4ce82
github.com/apache/thrift@v0.13.0
0.24.0
1
datamate/seafile-professional:11.0.202dd66b722464
thrift@0.16.0
0.24.0
1
datappeal/hive-metastore:lateste38c085a3567
libthrift@0.9.3
0.24.0
1
dbanda/livy:0.80ca125e68e53
libthrift@0.9.3
0.24.0
1
dremio/dremio-oss:24.1.080ed2e3b7c43
libthrift@0.13.0
0.24.0
1
easypi/openrefine:3.7.0d2950a36a576
libthrift@0.16.0
0.24.0
1
egdsandaru/apache-ranger-admin:1.0.0681baa1926f4
libthrift@0.13.0
0.24.0
1
elastic/apm-server:7.17.6c7a1c63257d0
github.com/apache/thrift@v0.14.2
0.24.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.