This vulnerability (CWE-125) in Apache Thrift allows an attacker to perform out-of-bounds reads, potentially exposing sensitive information such as cryptographic keys or memory addresses, which could be leveraged to bypass protection mechanisms like ASLR. It can also cause application crashes resulting in denial of service. The issue affects Apache Thrift versions prior to 0.23.0. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) according to cve.org, with network attack vector, low complexity, no privileges required, and no user interaction. Red Hat advisories confirm the vulnerability and recommend upgrading to fixed versions.

An attacker can exploit this vulnerability to read memory beyond buffer boundaries, potentially disclosing sensitive information such as cryptographic keys or personally identifiable information. This can also lead to denial of service through application crashes. The vulnerability does not impact integrity but affects confidentiality and availability. There are no known exploits in the wild at this time.

A fix is available in Apache Thrift version 0.23.0. Users should upgrade to this version or later to remediate the vulnerability. Red Hat has issued security advisories and errata addressing this issue for their affected products. No alternative mitigations are specified by the vendor.