CVE-2025-48431
Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.
| CWE | CWE-762 |
| Vendor | apache software foundation |
| Product | apache thrift |
| Published | Apr 28, 2026 |
| Last Updated | Jul 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache thrift
Be the first to know when new high vulnerabilities affecting apache software foundation apache thrift are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache Thrift
0 < 0.23.0
References
lists.apache.org: https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql openwall.com: http://www.openwall.com/lists/oss-security/2026/04/28/8 access.redhat.com: https://access.redhat.com/security/cve/CVE-2025-48431 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2463410 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-48431.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:28010 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36882 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24539 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:25273 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:27126
Credits
Hasnain Lakhani Hasnain Lakhani