Description (CNA)
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Apache Software Foundation / Apache Thrift | affected 0 before 0.23.0 |
CWE
CWE-762
References
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.
A flaw was found in Apache Thrift c_glib language bindings. A remote attacker could send specially crafted requests to a c_glib-based Thrift server, leading to a mismatched memory management routines vulnerability. This could cause the server to crash with a "free(): invalid pointer" error, resulting in a Denial of Service (DoS).
- https://access.redhat.com/security/cve/CVE-2025-48431
- https://bugzilla.redhat.com/show_bug.cgi?id=2463410
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-48431.json
- https://access.redhat.com/errata/RHSA-2026:28010
- https://access.redhat.com/errata/RHSA-2026:36882
- https://access.redhat.com/errata/RHSA-2026:24539
- https://access.redhat.com/errata/RHSA-2026:25273
- https://access.redhat.com/errata/RHSA-2026:27126