Apache Thrift’s TZlibTransport decompresses incoming data without enforcing a limit on the decompressed size, a flaw that permits data amplification. When a compressed payload expands to an unrealistically large volume, the library attempts to allocate memory and process this data, which can disrupt service availability. The weakness is identified as CWE-409 due to improper handling of sensitive data sizes.

All supported bindings—C++, Java, Python, Go, D, and C/GLib—are affected in any release before 0.24.0. Users deploying these versions are vulnerable across all languages.

The CVSS score of 8.7 marks the vulnerability as high severity, while the EPSS score of 1% indicates a low but non‑zero chance of exploitation. The flaw is not listed in CISA KEV, suggesting no widespread active exploitation has yet been observed. The likely attack vector is a remote attacker with access to the Thrift service who sends a specially crafted, highly compressed payload that expands beyond expected limits. Successful exploitation would cause resource exhaustion, leading to denial of service.