Review reviewHigh

CVE-2025-48431

Apache Software Foundation Apache Thrift, Cryostat 4 on RHEL 9, Red Hat Advanced Cluster Management for Kubernetes 2.14

Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.

CVSS: 7.5
EPSS: 1.08%
CISA KEV: Not listed
Published: 2026.04.28

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability1.08%

Technical severityCVSS 7.5

Vulnerability overview

Affected product and versions

Product: Apache Software Foundation Apache Thrift, Cryostat 4 on RHEL 9, Red Hat Advanced Cluster Management for Kubernetes 2.14
Affected versions: < 0.23.0
Fixed versions: 0.23.0

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Apache Software Foundation Apache Thrift, Cryostat 4 on RHEL 9, Red Hat Advanced Cluster Management for Kubernetes 2.14 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-762, CWE-763