Apache Thrift CVE-2025-48431

Upgrade to Apache Thrift version 0.23.0 or later, which contains the fix for mismatched memory management in c_glib bindings. Download from official Apache Thrift releases and verify checksums. Full vendor advisory with upgrade instructions available at https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql. If immediate upgrade is not feasible, implement network-level compensating controls: deploy rate limiting on Thrift endpoints to mitigate DoS impact (reduces attacker's ability to sustain crashes but does not prevent individual crashes); restrict Thrift server access to trusted networks only via firewall rules (eliminates remote attack vector but breaks internet-facing services); deploy monitoring for 'free(): invalid pointer' crashes with automatic service restart (maintains availability but does not prevent exploitation). Workaround trade-offs: rate limiting may impact legitimate high-volume clients; network restrictions require VPN/allowlist management overhead; auto-restart creates brief service interruptions and may mask ongoing attacks. Migration to a non-c_glib language binding (if application architecture permits) provides complete mitigation but requires code refactoring.