The vulnerability is an uncontrolled recursion in the Apache Thrift c_glib dispatch layer that can cause a stack overflow. If an attacker sends a specially crafted request, the dispatcher recurses without bounds, exhausting stack memory. This can lead to a denial‑of‑service.

The flaw exists in Apache Thrift packages prior to version 0.23.0. Systems running any of these older releases are susceptible. Upgrading to 0.23.0 or later removes the recursion flaw.

The CVSS score is 5.3, indicating moderate severity, and the EPSS score is <1%, suggesting a low likelihood of exploitation. The flaw is not currently listed in CISA KEV. Based on the server‑side nature of Thrift, the attack vector is inferred to be a remote attacker sending malicious RPC payloads. No exploitation proof has been disclosed yet, but the absence of mitigations in older versions makes exploitation plausible if a trusted client sends the recursive input.