new file mode 100644
@@ -0,0 +1,67 @@
+From 0fe80cef02c1d3260d3ce278f072ce7e04788c13 Mon Sep 17 00:00:00 2001
+From: dxbjavid <dxbjavid@gmail.com>
+Date: Sat, 13 Jun 2026 17:39:53 +0530
+Subject: [PATCH] fix off-by-ten header bounds check in readHeaderFormat
+
+Backport note: additive test conflict in ThrifttReadCheckTests.cpp; the 0.22.0
+tree already carries test_theadertransport_zlib_roundtrip from CVE-2026-55971,
+so both tests were kept.
+
+Assisted-by: kiro:claude-sonnet-5
+
+CVE: CVE-2026-55970
+Upstream-Status: Backport [https://github.com/apache/thrift/commit/4da36faeef0b7db4b1dea560b01eb15957335934]
+
+Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
+---
+ .../src/thrift/transport/THeaderTransport.cpp | 5 ++++-
+ lib/cpp/test/ThrifttReadCheckTests.cpp | 22 +++++++++++++++++++
+ 2 files changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/lib/cpp/src/thrift/transport/THeaderTransport.cpp b/lib/cpp/src/thrift/transport/THeaderTransport.cpp
+index 117c8edd5..0711a547e 100644
+--- a/lib/cpp/src/thrift/transport/THeaderTransport.cpp
++++ b/lib/cpp/src/thrift/transport/THeaderTransport.cpp
+@@ -206,7 +206,10 @@ void THeaderTransport::readHeaderFormat(uint16_t headerSize, uint32_t sz) {
+ }
+ headerSize *= 4;
+ const uint8_t* const headerBoundary = ptr + headerSize;
+- if (headerSize > sz) {
++ // ptr already skips the 10-byte common header, so the header section has to
++ // fit in the remaining sz - 10 bytes; comparing against sz alone let the
++ // boundary sit up to 10 bytes past the receive buffer.
++ if (headerSize > sz - 10) {
+ throw TTransportException(TTransportException::CORRUPTED_DATA,
+ "Header size is larger than frame");
+ }
+diff --git a/lib/cpp/test/ThrifttReadCheckTests.cpp b/lib/cpp/test/ThrifttReadCheckTests.cpp
+index 72e798bc1..4645a9e14 100644
+--- a/lib/cpp/test/ThrifttReadCheckTests.cpp
++++ b/lib/cpp/test/ThrifttReadCheckTests.cpp
+@@ -341,4 +341,26 @@ BOOST_AUTO_TEST_CASE(test_theadertransport_zlib_roundtrip) {
+ BOOST_CHECK(out == payload);
+ }
+
++BOOST_AUTO_TEST_CASE(test_theadertransport_header_size_exceeds_frame) {
++ using apache::thrift::transport::THeaderTransport;
++ // Header-format frame whose declared header size (3 * 4 = 12) leaves fewer
++ // than the 10 common-header bytes inside the 14-byte frame. The trailing
++ // varint bytes are all continuation bytes, so the reader used to run off the
++ // end of the receive buffer.
++ uint8_t frame[] = {
++ 0x00, 0x00, 0x00, 0x0E, // frame length = 14
++ 0x0F, 0xFF, 0x00, 0x00, // header magic
++ 0x00, 0x00, 0x00, 0x00, // seqId
++ 0x00, 0x03, // header size field (3 -> 12 bytes)
++ 0x02, // protocol id varint
++ 0x00, // num transforms = 0
++ 0x80, 0x80 // info-header varint, all continuation
++ };
++ std::shared_ptr<TMemoryBuffer> buffer(new TMemoryBuffer(frame, sizeof(frame)));
++ std::shared_ptr<THeaderTransport> trans(new THeaderTransport(buffer));
++
++ uint8_t out[1];
++ BOOST_CHECK_THROW(trans->read(out, sizeof(out)), TTransportException);
++}
++
+ BOOST_AUTO_TEST_SUITE_END()
@@ -20,6 +20,7 @@ SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \
file://CVE-2026-41608.patch \
file://CVE-2026-45112.patch \
file://CVE-2026-55969.patch \
+ file://CVE-2026-55970.patch \
"
SRC_URI[sha256sum] = "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5"
Backport patch to fix CVE-2026-55970. References: https://nvd.nist.gov/vuln/detail/CVE-2026-55970 Upstream fix: https://github.com/apache/thrift/commit/4da36faeef0b7db4b1dea560b01eb15957335934 Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech> --- .../thrift/thrift/CVE-2026-55970.patch | 67 +++++++++++++++++++ .../thrift/thrift_0.22.0.bb | 1 + 2 files changed, 68 insertions(+) create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55970.patch