Critical Flaws in Apache Thrift Threaten Multi-Language

Apache Thrift released an urgent 0.23.0 update addressing three security flaws across its Rust, Java, and Node.js implementations: a memory-allocation exhaustion leading to DoS, a Java TLS hostname verification failure that can enable Man-in-the-Middle interception, and a multi-vulnerability issue in Node.js (path traversal, HTTP splitting, origin validation errors, and resource exhaustion). Organizations using Thrift should upgrade immediately and audit multi-language service dependencies to mitigate cascading risks.