The issue is an improper handling of highly compressed data in the Ruby THeaderTransport of Apache Thrift. The vulnerability arises when the server decompresses ZLIB‑compressed payloads without bounding the amount of data that can be produced by the compression. An attacker can supply a small compressed blob that expands to a huge uncompressed string, causing the Ruby runtime to allocate a large amount of memory and potentially crash or become extremely slow. This is a classic decompression‑bomb scenario, identified as a Data Amplification flaw (CWE‑409).

Vendors: Apache Software Foundation. Product: Apache Thrift Ruby bindings. All versions before 0.24.0 are affected; versions 0.24.0 and later include the fix.

The CVSS score of 7.5 indicates a high severity, and the EPSS score of 1 % indicates a very low but non‑zero exploitation probability, while the lack of a KEV listing does not preclude an active exploit. The probable attack vector is a remote client that sends a maliciously compressed message to a Thrift service. Because the flaw does not require local privileges and operates over the network, an attacker with network access to the Thrift service can trigger memory exhaustion, leading to denial of service of the affected process.