Apache Thrift’s Rust bindings allow a non‑strict binary protocol path to read strings without enforcing size limits, causing unchecked memory allocation. An attacker can supply excessively large strings, exhausting server memory and potentially crashing the service. The weakness is identified as CWE‑770, missing limits on resource allocation.

All installations of Apache Thrift that use the Rust bindings and are running a version earlier than 0.24.0 are affected. The issue is not present in 0.24.0 or later.

The CVSS score of 8.7 reflects a high severity risk, indicating both significant impact and realistic attacker capability. The EPSS score of 1% indicates a very low but nonzero likelihood of exploitation, and the vulnerability is not currently listed in CISA’s KEV catalog. The attack vector is believed to be remote, as it can be triggered by an attacker sending a maliciously crafted Thrift payload to an exposed service endpoint. With no throttling or size checks, a single request can consume large amounts of memory, leading to application or system instability.