Fluid Attacks Database

Description

Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	thrift	=0.19.0-4 \|\| =0.20.0-1 \|\| =0.22.0-1 \|\| =0.22.0-2 \|\| =0.22.0-3 \|\| =0.22.0-4 \|\| =0.23.0-1 \|\| =0.23.0-2 \|\| =0.23.0-3 \|\| =0.24.0-1 \|\| =0.24.0-2	-
debian 14	thrift	=0.19.0-4 \|\| =0.20.0-1 \|\| =0.22.0-1 \|\| =0.22.0-2 \|\| =0.22.0-3 \|\| =0.22.0-4 \|\| =0.23.0-1 \|\| =0.23.0-2 \|\| >=0 <0.23.0-3	0.23.0-3
debian 12	thrift	=0.17.0-2 \|\| =0.17.0-3 \|\| =0.17.0-4 \|\| =0.18.1-1 \|\| =0.18.1-2 \|\| =0.19.0-1 \|\| =0.19.0-2 \|\| =0.19.0-2.1 \|\| =0.19.0-2.1~exp1 \|\| =0.19.0-3 \|\| =0.19.0-4 \|\| =0.20.0-1 \|\| =0.22.0-1 \|\| =0.22.0-2 \|\| =0.22.0-3 \|\| =0.22.0-4 \|\| =0.23.0-1 \|\| =0.23.0-2 \|\| =0.23.0-3 \|\| =0.24.0-1 \|\| =0.24.0-2	-

Aliases

1. CVE-2025-484312. NVD-2025-484313. OSV-DEBIAN-2025-484314. OSV-2025-484315. SECURITY-TRACKER-CVE-2025-48431

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.