The vulnerability in Apache Thrift Java TSaslTransport allows an attacker to send large data frames after authentication without any size limit. This can cause excessive memory allocation and potentially crash the process or exhaust system resources, leading to a denial of service.

Apache Thrift Java bindings from the Apache Software Foundation are affected for all releases prior to 0.25.0. The recommended action is to upgrade to version 0.25.0 or later.

The CVSS score of 7.1 indicates high severity, and the EPSS score is not available, so the probability of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly disclosed exploits. The attack vector is inferred to be remote, through the Thrift service, requiring an attacker who can establish a connection and send oversized frames. The impact remains limited to availability, but in a clustered or production environment the denial of service could propagate.