CVE-2025-48431: CWE-762 Mismatched Memory Management Routines in Apache Software Foundation Apache Thrift
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.
AI Analysis
Technical Summary
This vulnerability in Apache Thrift c_glib language bindings (CVE-2025-48431) is due to mismatched memory management routines (CWE-762). Specifically, specially crafted requests can trigger a crash in the Thrift server caused by an invalid pointer free operation, leading to denial of service. The flaw affects all versions prior to 0.23.0. The issue is confirmed and documented by Red Hat advisories, which recommend upgrading to version 0.23.0 to fix the problem. There are no known exploits in the wild as of the latest information.
Potential Impact
The vulnerability causes a denial of service by crashing the Apache Thrift c_glib server with a fatal memory management error. It does not affect confidentiality or integrity but disrupts availability of the affected service. The CVSS score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.
Mitigation Recommendations
A fix is available in Apache Thrift version 0.23.0. Users should upgrade to this version to remediate the vulnerability. The Red Hat advisories confirm the availability of this update and recommend applying it. There is no indication that any temporary workaround or other mitigation is required or effective.
CVE-2025-48431: CWE-762 Mismatched Memory Management Routines in Apache Software Foundation Apache Thrift
Description
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Apache Thrift c_glib language bindings (CVE-2025-48431) is due to mismatched memory management routines (CWE-762). Specifically, specially crafted requests can trigger a crash in the Thrift server caused by an invalid pointer free operation, leading to denial of service. The flaw affects all versions prior to 0.23.0. The issue is confirmed and documented by Red Hat advisories, which recommend upgrading to version 0.23.0 to fix the problem. There are no known exploits in the wild as of the latest information.
Potential Impact
The vulnerability causes a denial of service by crashing the Apache Thrift c_glib server with a fatal memory management error. It does not affect confidentiality or integrity but disrupts availability of the affected service. The CVSS score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.
Mitigation Recommendations
A fix is available in Apache Thrift version 0.23.0. Users should upgrade to this version to remediate the vulnerability. The Red Hat advisories confirm the availability of this update and recommend applying it. There is no indication that any temporary workaround or other mitigation is required or effective.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2025-05-20T20:27:01.040Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2025-48431","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:28010","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:24539","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:25273","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:27126","vendor":"Red Hat"}]
Threat ID: 69f086bfcbff5d8610f34264
Added to database: 04/28/2026, 10:06:55 UTC
Last enriched: 07/30/2026, 22:16:08 UTC
Last updated: 07/31/2026, 21:26:45 UTC
Views: 119
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.