CVE-2026-66053: Apache Thrift: Python TSSLSocket Hostname Matcher Import
Published Jul 24, 2026
·Updated
Affected Software
1 affected component
Apache Thrift
CVE-2026-66053 is classified with a high severity due to the potential for a hostname verification bypass in TSSLSocket.
To fix CVE-2026-66053, update Apache Thrift to the latest version that addresses this vulnerability.
CVE-2026-66053 can lead to man-in-the-middle attacks by allowing attackers to spoof hostnames.
CVE-2026-66053 affects specific versions of Apache Thrift prior to the patched release that addresses the hostname matcher issue.
Yes, CVE-2026-66053 directly involves the security of SSL/TLS connections in Apache Thrift.