CVE-2026-85087: Improper Certificate Validation

🗓️ 02 Oct 2026 00:00:00Reported by Rapid7Type

Improper certificate validation and wrong status code in Apache Thrift python bindings.

Reporter	Title	Published	Views	Family All 16
CVE	CVE-2026-85087	2 Oct 202611:35	–	cve
Cvelist	CVE-2026-85087 Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op	2 Oct 202611:35	–	cvelist
Debian CVE	CVE-2026-85087	2 Oct 202611:35	–	debiancve
EUVD	EUVD-2026-91417	2 Oct 202611:35	–	euvd
Mend	CVE-2026-85087	2 Oct 202611:35	–	mend
Microsoft CVE	Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op	3 Oct 202608:02	–	mscve
NVD	CVE-2026-85087	2 Oct 202612:17	–	nvd
OSV	AZL-105386 CVE-2026-85087 affecting package thrift 0.24.0-1	2 Oct 202612:17	–	osv
OSV	DEBIAN-CVE-2026-85087	2 Oct 202612:17	–	osv
OSV	ECHO-EEB1-DF32-DBAA The vulnerable code postdates this version. The Python >= 3.12 no-op host-name matcher (sslcompat returning True when ssl.match_hostname is missing) was introduced by 23e0e5ce (first released in 0.22.0) and is not an ancestor of v0.19.0. On trixie's Python 3.13 this version's sslcompat falls back to legacy_validate_callback, which compares the certificate commonName and raises on a mismatch; TSSLSocket uses PROTOCOL_SSLv23 (the PROTOCOL_TLS alias) with check_hostname off, so that callback is the check that runs. Verified with real handshakes against the built lib on Python 3.13.5: a certificate for "localhost" offered to a client expecting "wrong.example" is refused with the default ssl_version, with an explicit PROTOCOL_TLS (the upstream regression case) and with PROTOCOL_TLSv1_2, and TSSLServerSocket refuses a trusted client certificate issued for another identity. The same script against upstream v0.24.0's lib accepts both explicit-ssl_version mismatches, as the CVE describes. The fix d6782a87 restores a real matcher in sslcompat (code this version never lost) and turns on check_hostname for explicit-ssl_version contexts, which 0.19.0 does not need because open() always runs _validate_callback. Same reasoning as CVE-2026-66053.	3 Oct 202609:20	–	osv