CVE-2025-48431 Apache CVE debrief

Who should care

Users of Apache Thrift c_glib language bindings, especially those using versions before 0.23.0, should be aware of this vulnerability. Apache Thrift users who have not upgraded to version 0.23.0 are at risk. Security teams and administrators responsible for maintaining and updating software dependencies should prioritize upgrading to the fixed version.

Technical summary

The vulnerability is caused by mismatched memory management routines in the c_glib language bindings of Apache Thrift. This can lead to a crash of the c_glib-based Thrift server when specially crafted requests are received. The error message 'free(): invalid pointer' indicates a memory management issue. The vulnerability has been assigned a CVSS score of 7.5, indicating a HIGH severity. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Defensive priority

This vulnerability has a HIGH CVSS score of 7.5 and can cause a denial of service (DoS) by crashing the server. Therefore, it is recommended to prioritize upgrading to version 0.23.0 of Apache Thrift.

Recommended defensive actions

• Upgrade Apache Thrift to version 0.23.0 or later
• Review and update affected systems and dependencies
• Monitor for and block specially crafted requests
• Implement compensating controls to mitigate potential impact
• Verify and validate memory management routines in related code

Evidence notes

The CVE-2025-48431 vulnerability was published on April 28, 2026, and last modified on July 1, 2026. The vulnerability affects Apache Thrift versions before 0.23.0. The CVSS score is 7.5, indicating a HIGH severity. The CWE-762 and CWE-763 weaknesses are associated with this vulnerability.

Official resources