CVE-2025-48431
🟡 Monitoruj
Błąd zarządzania pamięcią w Apache Thrift może spowodować awarię serwera c_glib.
CVSS
7.5
EPSS
1.1%
Exploit
none
Vendor
apache
Opis źródłowy (NVD)
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.
brak
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.5 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 1.1% |
| Opublikowano (NVD) | 2026-04-28 10:16:02 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-07 09:10:00 UTC |
Referencje
- https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql ([email protected]) [Mailing List, Patch, Release Notes]
- http://www.openwall.com/lists/oss-security/2026/04/28/8 (af854a3a-2127-422b-91ae-364da2661108) [Mailing List]
- https://access.redhat.com/errata/RHSA-2026:24539 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
- https://access.redhat.com/errata/RHSA-2026:25273 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
- https://access.redhat.com/errata/RHSA-2026:27126 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
- https://access.redhat.com/errata/RHSA-2026:28010 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
- https://access.redhat.com/errata/RHSA-2026:36882 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
- https://access.redhat.com/security/cve/CVE-2025-48431 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
- https://bugzilla.redhat.com/show_bug.cgi?id=2463410 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-48431.json (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)