Apache Thrift versions prior to 0.23.0 contain an out-of-bounds read vulnerability (CWE-125) that can allow attackers to access memory beyond allocated buffers. This can result in disclosure of sensitive information such as cryptographic keys or memory addresses, which may aid in bypassing security mechanisms like ASLR. Additionally, the vulnerability can cause application crashes leading to denial of service conditions. The vulnerability is remotely exploitable without authentication or user interaction. The CVSS v3.1 base score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). Red Hat advisories confirm the issue and recommend upgrading to version 0.23.0 where the flaw is fixed.

An attacker can exploit this vulnerability to read memory outside the intended bounds, potentially disclosing sensitive information such as cryptographic keys or personally identifiable information. This memory disclosure can facilitate further attacks by bypassing protection mechanisms. Additionally, the vulnerability can cause application crashes resulting in denial of service. There is no integrity impact reported. The vulnerability is exploitable remotely without privileges or user interaction.

A fix is available in Apache Thrift version 0.23.0. Users are strongly advised to upgrade to this version to remediate the vulnerability. Red Hat has issued security advisories and errata addressing this issue for affected products. If upgrading immediately is not possible, monitor vendor advisories for any available mitigations or workarounds. No vendor advisory indicates that no action is required or that the issue is already mitigated without patching.