CVE-2025-48431

Fixed in a distro release EPSS 1%CVSS 7.5

Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.

Published 2026-04-28 · CVE record · OSV

Products: Apache Software Foundation Apache Thrift, Red Hat Cryostat 4 on RHEL 9, Red Hat Advanced Cluster Management for Kubernetes 2.14, Red Hat Advanced Cluster Management for Kubernetes 2.15, Red Hat Advanced Cluster Management for Kubernetes 2.16, Red Hat OpenShift distributed tracing 3.10.2, Red Hat Multicluster Global Hub, Red Hat OpenShift Service Mesh 2, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat AI Inference Server, Red Hat Ceph Storage 5, Red Hat Ceph Storage 6, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, Red Hat Enterprise Linux 8, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenShift distributed tracing 3, Red Hat OpenStack Platform 18.0

Distro releases