Junglewise Threat Intelligence

CVE-2025-48431: Apache Thrift denial of service in c_glib language bindings

CVE-2025-48431 · Severity: high · CVSS 7.5 · Published 2026-04-28

Technologies: Apache Thrift. Vendors: Apache.

Executive brief

Apache Thrift is a popular framework used for cross-language software development and communication between different services. A vulnerability in its C-based library (c_glib) allows remote attackers to crash servers by sending specially crafted network requests. This can lead to a total service outage, disrupting business operations and application availability.

Technical details

A vulnerability exists in the Apache Thrift c_glib language bindings due to mismatched memory management routines (CWE-762) and the release of invalid pointers (CWE-763). Specially crafted network requests can trigger an invalid pointer free operation, resulting in a fatal 'free(): invalid pointer' error that crashes the Thrift server. The attack can be executed remotely without authentication or user interaction. This issue affects all versions of Apache Thrift prior to 0.23.0. Users are advised to upgrade to version 0.23.0 to mitigate this risk.

Affected products

  • Apache Thrift before 0.23.0

Timeline

  • 2026-04-28: disclosed: Initial disclosure on oss-security mailing list
  • 2026-04-28: advisory: NVD and Apache advisory published
  • 2026-04-28: patched: Fixed in version 0.23.0

References

Related threats