CVE-2025-48431

HighCVSS 7.5/10Last modified Oct 7, 2026

Description

Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-762CWE-763

Affected software

VendorProductVersions
Apache Software FoundationApache Thrift< 0.23.0
Red HatCryostat 4 on RHEL 9—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.14—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.15—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.16—
Red HatRed Hat OpenShift distributed tracing 3.10.2—
Red HatMulticluster Global Hub—
Red HatOpenShift Service Mesh 2—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2—
Red HatRed Hat AI Inference Server—
Red HatRed Hat AI Inference Server—
Red HatRed Hat Ceph Storage 5—
Red HatRed Hat Ceph Storage 6—
Red HatRed Hat Ceph Storage 6—
Red HatRed Hat Ceph Storage 8—
Red HatRed Hat Ceph Storage 8—
Red HatRed Hat Ceph Storage 9—
Red HatRed Hat Ceph Storage 9—
Red HatRed Hat Ceph Storage 9—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift distributed tracing 3—
Red HatRed Hat OpenShift distributed tracing 3—
Red HatRed Hat OpenShift distributed tracing 3—
Red HatRed Hat OpenStack Platform 18.0—

References

Timeline

Published
Apr 28, 2026
Last modified
Oct 7, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-484325.3An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escapeCVE-2025-48449.8A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of CVE-2025-484436.6Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Local Privilege Escalation VulnerabilCVE-2025-484445.3Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 befoCVE-2025-484458.8Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce EurobanCVE-2025-484468.8Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce AlphabanCVE-2025-484477.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgallery allows Cross-Site CVE-2025-484486.5Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affectCVE-2025-48459.8A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functiCVE-2025-484595.3Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0.5. Users are recomCVE-2025-48469.8A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component MPUTCVE-2025-484615.0Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as
CVE-2025-48431: High severity, CVSS 7.5 | Vulnix