An out-of-bounds read vulnerability (CWE-125) exists in Apache Thrift versions prior to 0.23.0. This flaw allows an attacker to read memory beyond the allocated buffer, potentially exposing sensitive information and causing partial denial of service. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and availability. The issue is resolved by upgrading to Apache Thrift version 0.23.0. Red Hat has issued multiple advisories addressing this vulnerability in their product builds.

The vulnerability can lead to unauthorized disclosure of information due to out-of-bounds memory reads and may cause partial denial of service conditions. There is no indication of integrity impact. The CVSS score of 6.5 reflects a medium severity risk with network-based exploitation possible without authentication or user interaction.

A fix is available by upgrading Apache Thrift to version 0.23.0, which addresses this out-of-bounds read vulnerability. Users should apply this official update to remediate the issue. Red Hat has published security advisories and errata providing patches for affected Red Hat products incorporating Apache Thrift. Patch status is confirmed by vendor advisories linked in the references.