A memory management vulnerability in Apache Thrift allows unauthenticated remote attackers to crash affected services, resulting in a denial of service.

This vulnerability involves mismatched memory management routines within the c_glib language bindings. An unauthenticated attacker can send specially crafted requests that trigger an invalid pointer error, causing the Thrift server to crash.

The exploitation of this vulnerability results in a denial of service, which can disrupt critical business operations relying on Thrift for inter-service communication. With a CVSS score of 7.5, the vulnerability is classified as High severity due to its potential to cause significant service instability. The ability for unauthenticated attackers to trigger this condition remotely poses a substantial risk to system availability and reliability.

Immediate Action: Upgrade to Apache Thrift version 0.23.0 or later to apply the necessary memory management fixes.

Proactive Monitoring: Monitor system logs for abnormal service termination patterns or frequent "free(): invalid pointer" error messages indicative of exploitation attempts.

Compensating Controls: Implement network-level rate limiting or a Web Application Firewall (WAF) to filter malformed or suspicious traffic directed at Thrift-based endpoints.

Public Exploit Available: Unknown

Given the high CVSS severity and the ease with which a remote, unauthenticated attacker can crash services, administrators should prioritize updating to version 0.23.0. Patching is the only definitive way to resolve the underlying memory management flaw and restore service stability.