CVE-2025-48431 is a vulnerability in Apache Thrift's c_glib language bindings affecting versions before 0.23.0. It involves mismatched memory management routines that can be triggered by specially crafted remote requests, leading to a server crash with an invalid pointer free error. The flaw results in a denial of service condition by causing the server to terminate unexpectedly. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting a network attack vector with low complexity and no required privileges or user interaction. Red Hat has issued advisories confirming the impact and recommending upgrading to version 0.23.0, which contains the official fix.

The vulnerability allows unauthenticated remote attackers to cause a denial of service by crashing c_glib-based Apache Thrift servers. The crash occurs due to improper memory management leading to a "free(): invalid pointer" error. There is no impact on confidentiality or integrity, but availability is severely affected as the server process terminates unexpectedly, disrupting service.

An official fix is available in Apache Thrift version 0.23.0. Users should upgrade to this version or later to remediate the vulnerability. Red Hat has released security advisories and errata providing updates that include this fix. No alternative mitigations or workarounds are specified in the vendor advisory. Applying the update is the recommended course of action.