The vulnerability arises when a caller supplies an excessively large size value to the Rust implementation of Apache Thrift. Because the allocator is not bounded, the library may request more memory than intended, exhausting system resources or causing a crash. This can bring down services that depend on Thrift. The weakness is defined as CWE‑789: Uncontrolled Memory Allocation.

Apache Thrift before version 0.23.0 is affected. This includes all deployments that use the Rust client or server libraries distributed with Apache Thrift prior to that release. The vendor – Apache Software Foundation – has identified the issue in the generic Thrift library. Any system that incorporates these components and accepts external requests that may influence size parameters is at risk.

Exploitability is likely remote, given that the size value comes from external input in Thrift RPC calls. The EPSS score of < 1% indicates a very low exploitation probability. The absence of a KEV classification also suggests no confirmed widespread attacks, but the flaw can be severe if triggered. The CVSS score of 5.3 indicates a medium severity, reflecting a moderate impact on availability if exploited. Administrators should treat the vulnerability as high risk for availability disruption and apply the vendor’s patch promptly.