The vulnerability, identified as CWE‑297: Improper Validation of Certificate with Host Mismatch, is an improper validation of TLS certificates in Apache Thrift C++ bindings. Specifically, the TSSLSocket matchName() routine does not correctly enforce RFC 6125 host name matching rules, allowing a wildcard certificate that does not correspond to the intended host to be accepted. This flaw enables an attacker to present a forged certificate that matches a different hostname yet satisfies the client’s verification logic, effectively permitting man‑in‑the‑middle attacks and impersonation of legitimate servers. The primary impact is the loss of context authentication and potential exposure of sensitive data transmitted over the TLS connection.

Apache Thrift C++ bindings are affected, with all releases before version 0.24.0 vulnerable.

The CVSS score of 8.2 indicates high severity. The EPSS score of < 1% suggests that the likelihood of exploitation is very low but not zero. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves an attacker presenting a forged TLS certificate that matches a different hostname yet satisfies the client’s validation logic, allowing a man‑in‑the‑middle to intercept or tamper with traffic over an untrusted network. Once the client accepts the certificate, the attacker can access confidential data or alter communication, compromising confidentiality and integrity.