The vulnerability in the Apache Thrift c_glib bindings arises from a missing hostname verification step during TLS client connections. Because the client does not compare the certificate's Common Name or Subject Alternative Name against the intended hostname, an attacker can present a forged certificate that the client will accept. This flaw falls under CWE‑297 and allows a remote attacker to intercept, read, or modify encrypted traffic, effectively enabling a man‑in‑the‑middle attack.

The issue affects the Apache Thrift c_glib binding on all releases prior to 0.24.0. Systems using older Thrift releases and relying on this binding are vulnerable whether they are written in C++, Java, Python, or other languages that depend on c_glib. No further sub‑version details are listed, so all patches or services released before 0.24.0 should be considered impacted.

The CVSS score of 9.1 reflects a high severity. The EPSS score is reported as < 1%, indicating a very low but non‑zero probability of exploitation, but the lack of hostname verification makes the flaw attractive to attackers. The vulnerability is not listed in CISA's KEV catalog. An attacker would need network access to the Thrift service and could exploit the flaw without authentication, as it lies entirely in client‑side certificate validation logic.