Apache Thrift versions prior to 0.23.0 contain multiple vulnerabilities including improper origin validation (CWE-346), improper limitation of pathnames allowing path traversal (CWE-22), improper neutralization of CRLF sequences leading to HTTP request/response splitting (CWE-113), and uncontrolled resource consumption (CWE-400). These combined weaknesses can be exploited remotely without authentication, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N), potentially impacting confidentiality, integrity, and availability. The vendor has released version 0.23.0 which fixes these issues.

Exploitation of these vulnerabilities could allow an unauthenticated remote attacker to bypass origin validation controls, perform path traversal attacks, manipulate HTTP headers via request/response splitting, and cause resource exhaustion. This may result in limited data disclosure, data manipulation, and denial of service conditions. The CVSS score of 7.3 reflects a high severity with network attack vector and no privileges or user interaction required.

Users should upgrade Apache Thrift to version 0.23.0, which contains fixes for these vulnerabilities. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor advisory recommending this upgrade.