CVE-2026-85088

Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default access manager for client sockets — TSSLSocketFactory does so in C++, and the accessManager property does so in D — which compares the peer certificate against the host name that was connected to. That comparison walks the subjectAltName dNSName entries first and consults the certificate Common Name afterwards. A name that does not match yields a "skip" result rather than a rejection, so a certificate whose subjectAltName entries are all present and all non-matching falls through to the Common Name, which can then satisfy the check. RFC 6125 section 6.4.4, and RFC 9525 section 2, require that the Common Name is not consulted when a dNSName subjectAltName is present. A certificate carrying subjectAltName entries for one name and a Common Name for another is therefore accepted for a connection to the second name. Exploitation requires an attacker positioned on the network path who holds a certificate that chains to a certificate authority in the client's trust store and whose Common Name matches the connected host name. Public certificate authorities have not issued on Common Name alone for many years, so this is principally a concern for deployments using a private or enterprise public-key infrastructure. This issue affects the C++ library of Apache Thrift from 0.7.0 through 0.24.0 and the D library from 0.9.0 through 0.24.0. Users should upgrade to 0.25.0.

• CWE-295
• CWE-297

• https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1
• https://lists.apache.org/thread/zcgm7lx6037lvgvn87rc1tj3p0zhv371

Published

Oct 2, 2026

Last Modified

Oct 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85082Root Browser Classic 3.3.0 passes the path of a selected SQL…8.5
• CVE-2026-85083The ANJIA AJL33PC0801 IP camera uses a hard-coded credential…6.8
• CVE-2026-85084Out-of-bounds Write and Improper Validation of Array Index v…6.3
• CVE-2026-85085The Canva Android App before 2.376.0 allowed an external ori…9.6
• CVE-2026-85086Improper certificate validation, Initialization of a resourc…6.9
• CVE-2026-85087Improper certificate validation, Return of wrong status code…6.9
• CVE-2026-85089FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transm…6.5
• CVE-2026-8509Heap buffer overflow in WebML in Google Chrome prior to 148.…8.8
• CVE-2026-85090FreeRDP before 3.31.0 contains a heap out-of-bounds read vul…5.4
• CVE-2026-85091zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer ov…7.4
• CVE-2026-85092LiME through 1.12.0 fails to validate the disk acquisition o…6.6
• CVE-2026-85093Cheshire Cat AI's GET /memory/collections/{collection_id}/po…6.5