The vulnerability in Apache Thrift’s Python bindings arises from an improper host‑name check that silently becomes a no‑op when running on Python versions 3.12 and later. This flaw allows an attacker to bypass certificate validation and potentially intercept or inject traffic to a trusted Thrift server. The weakness results in the return of an incorrect status code and opens the door to man‑in‑the‑middle attacks that compromise confidentiality and integrity of the data exchanged over the network.

Apache Thrift versions prior to 0.25.0 are affected by this issue. The flaw is present in all builds utilizing the Python bindings, regardless of the platform, as the host‑name validation logic is part of the universal Thrift client implementation.

The CVSS score of 6.9 indicates a moderate severity. Because the EPSS score is not available, the current exploitation probability is unknown, and the vulnerability is not listed in CISA KEV, there is no publicly documented exploitation at the time of this analysis. Attackers would need network access must trigger the client’s insecure TLS handshake. If they succeed, they could masquerade as the legitimate server and gain unauthorized access to the data flow.