Apache Thrift's C++ and D libraries use a default access manager for client sockets that validates peer certificates by first checking subjectAltName dNSName entries and then the Common Name if no match is found. According to RFC 6125 section 6.4.4 and RFC 9525 section 2, the Common Name must not be consulted when subjectAltName dNSName entries are present. However, the libraries accept certificates where subjectAltName entries do not match but the Common Name does, allowing a certificate with mismatched subjectAltName but matching Common Name to be accepted. Exploitation requires an attacker on the network path with a certificate chaining to a trusted CA and a Common Name matching the connected host. Public CAs no longer issue certificates based solely on Common Name, so this mainly affects private or enterprise PKI deployments. The vulnerability affects Apache Thrift C++ versions 0.7.0 through 0.24.0 and D versions 0.9.0 through 0.24.0. The issue is fixed in version 0.25.0.

An attacker positioned on the network path who possesses a certificate chaining to a trusted CA and with a Common Name matching the connected host name can bypass proper hostname validation. This could allow man-in-the-middle attacks in environments using private or enterprise PKI where certificates with mismatched subjectAltName and Common Name are accepted. Public CA-issued certificates are unlikely to be exploitable due to modern issuance policies. The CVSS 4.0 score is 6.9 (medium severity), reflecting the network attack vector, high complexity, and partial impact on confidentiality and integrity.

Users should upgrade Apache Thrift C++ and D libraries to version 0.25.0 or later, where this certificate validation issue is fixed. No other mitigations are indicated. Patch status is confirmed by the vendor advisory specifying upgrade to 0.25.0.