The vulnerability resides in Armeria versions before 1.43.0, where malformed Thrift messages trigger unusually large memory allocations. This can exhaust system resources and cause the affected service to become unresponsive or crash, effectively denying service to legitimate users. The weakness is a form of uncontrolled resource consumption, as stated by the CWE category "Excessive Allocation of Resources".

The flaw affects the LY Corporation’s Armeria framework, specifically any release earlier than 1.43.0. Organizations running custom servers or clients that use Thrift over Armeria and have not upgraded to 1.43.0 or later are vulnerable.

The CVSS score of 8.7 classifies the issue as high severity. With an EPSS score not available, the exploitation likelihood cannot be quantified but peers suggest remote exploit via network communication. The vulnerability is not currently listed in the CISA KEV catalog. An attacker can craft a malicious Thrift payload and send it over an exposed Armeria endpoint, causing memory exhaustion and a denial of service.