Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. (CVE-2026-85088)

The vulnerability in Apache Thrift's C++ and D libraries involves improper validation of TLS certificates during hostname verification. The default access managers check the peer certificate's subjectAltName dNSName entries first and then the Common Name if no dNSName matches. According to RFC 6125 section 6.4.4 and RFC 9525 section 2, the Common Name must not be consulted if subjectAltName dNSName entries are present. However, the libraries accept certificates where subjectAltName entries do not match the host but the Common Name does, allowing a certificate with mismatched subjectAltName to be accepted. Exploitation requires an attacker on the network path possessing a certificate chaining to a trusted CA in the client's store and with a Common Name matching the connected host. Public CAs have not issued certificates based solely on Common Name for years, so this is mainly a risk in private or enterprise PKI environments. The affected versions are C++ library 0.7.0 through 0.24.0 and D library 0.9.0 through 0.24.0, with a fix available in 0.25.0.

An attacker positioned on the network path who holds a certificate chaining to a trusted CA and with a Common Name matching the connected host can bypass proper hostname verification if the certificate's subjectAltName entries do not match the host. This can lead to man-in-the-middle attacks in environments using private or enterprise PKI where certificates may be issued with mismatched subjectAltName and Common Name fields. Public CA-issued certificates are unlikely to be exploitable due to modern issuance practices.

Users should upgrade Apache Thrift C++ and D libraries to version 0.25.0 or later, where this certificate validation issue is fixed. Until upgraded, deployments using private or enterprise PKI should carefully review certificate issuance policies to avoid certificates with mismatched subjectAltName and Common Name fields. No other vendor advisory or patch information is provided; patch status is confirmed by the version upgrade recommendation.