The vulnerability identified as CVE-2026-41602 involves an integer overflow or wraparound in the Apache Thrift TFramedTransport implementation written in Go. This flaw can lead to resource exhaustion or unexpected behavior causing denial of service conditions. It affects Apache Thrift versions prior to 0.23.0. Red Hat's advisory confirms the issue and states that the problem is fixed in Red Hat OpenShift distributed tracing platform (Tempo) version 3.9.3. The integer overflow could cause crashes, excessive resource consumption, or instability. The fix involves correct handling of integer operations to prevent overflow conditions.

The integer overflow vulnerability can cause denial of service by crashing the application or exhausting system resources. There is no impact on confidentiality or integrity reported. The flaw could lead to instability or unexpected behavior in affected systems. No known active exploits have been reported. The vulnerability affects availability by potentially causing application crashes or resource exhaustion.

A fix is available and users are strongly recommended to upgrade to Apache Thrift version 0.23.0 or later. For Red Hat OpenShift distributed tracing platform (Tempo), version 3.9.3 includes the fix. Apply the vendor-provided updates as per Red Hat's advisory RHSA-2026:14885. No additional mitigations are required beyond applying the official patches.