Apache Thrift’s Python bindings allow an attacker to send highly compressed data to the THeaderTransport layer, causing an unbounded zlib decompression that amplifies memory usage. The flaw is a classic data‑amplification problem, identified as CWE‑409, and can exhaust system resources, leading to a denial of service. No other confidentiality or integrity impact is described in the available data.

The vulnerability affects the Apache Thrift library, specifically any Python bindings released before version 0.24.0. Systems that expose a Thrift service using these bindings are potentially exposed, regardless of operating system or deployment environment.

The CVSS score of 7.5 indicates a high‑severity data‑amplification vulnerability, and the EPSS score of 1% reflects a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can craft a large compressed payload and send it over the network to a Thrift service, triggering uncontrolled decompression and memory exhaustion. The likelihood of exploitation increases for services exposed to untrusted networks.