An integer overflow or wraparound vulnerability (CWE-190) exists in Apache Thrift versions prior to 0.23.0. This vulnerability can cause unexpected behavior such as resource exhaustion, crashes, or data corruption depending on how the overflow is triggered and handled. The flaw may lead to denial of service conditions by causing excessive resource consumption or instability. It may also result in memory corruption or bypass of protection mechanisms if the overflow triggers buffer overflows or incorrect security decisions. The vulnerability has a CVSS v3.1 base score of 7.3 (high severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Red Hat advisories confirm the issue and recommend upgrading to fixed versions. No known exploits in the wild have been reported.

The vulnerability can lead to denial of service through crashes or resource exhaustion, potentially impacting system availability. It may also cause data corruption or memory modification, affecting system integrity. In some cases, it could allow bypassing protection mechanisms or executing unauthorized code if buffer overflows are triggered. The exact impact depends on how the integer overflow is exploited within the application context.

A fix is available in Apache Thrift version 0.23.0; users should upgrade to this version or later to remediate the vulnerability. Red Hat has published advisories and errata addressing this issue for their products. Users of affected Red Hat products should apply the relevant security updates as provided by Red Hat. No additional mitigations are specified beyond applying the official fix.