The vulnerability allows an attacker to trigger resource exhaustion by causing the Apache Thrift Java bindings to read an unbounded amount of data. The description states that the server allocates resources without limits; it is inferred from the advisory that a specially crafted request could cause that unbounded read, although the exact trigger is not explicitly documented. This can lead to excessive memory or CPU consumption and a denial of service. The issue is a resource exhaustion flaw (CWE-770).

Apache Thrift, Java bindings, version 0.19.0 through 0.23.x are affected. Any deployment of these versions that exposes a Thrift server to untrusted network traffic is at risk.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of 2% suggests a low but non-zero probability of exploitation. The flaw is not listed in CISA KEV, implying no widespread active exploitation. It is inferred from the description that a remote attacker could trigger the flaw by sending a request that causes the server to read an unbounded amount of data, though no proof‑of‑concept or exploitation details are documented.