The flaw occurs in Apache Thrift’s TSSLTransportFactory where certificate hostname verification is performed incorrectly. An attacker who can present a TLS certificate that does not match the intended server hostname will be accepted by the client, allowing a man‑in‑the‑middle attack. This leads to potential confidentiality and integrity compromise of data transmitted over the Thrift connection.

Apache Thrift versions prior to 0.23.0 are affected. The vulnerability applies to all builds of Thrift distributed by the Apache Software Foundation that use the TSSLTransportFactory.

The CVSS score is 7.4, but the EPSS score of <1% indicates a low probability of exploitation in the wild. It is inferred that the attack vector is a remote man‑in‑the‑middle via TLS interception, requiring only that the client accepts a certificate with a host mismatch. The vulnerability is not listed in the CISA KEV catalog, but a successful exploitation would still allow an attacker to read or tamper with Thrift traffic.