The flaw arises from an uncontrolled allocation of resources within the Go bindings of Apache Thrift. An attacker can send a single, unauthenticated packet that causes the internal counter used by the THeader transform to overflow, leading to an out‑of‑memory or crash state. This results in a denial‑of‑service on the affected Thrift server instance.

All releases of the Apache Thrift Go bindings prior to version 0.25.0 are impacted. These are published by the Apache Software Foundation as part of the Apache Thrift project. Systems that expose a Go‑based Thrift server and accept network traffic from potential unauthenticated clients are therefore susceptible. No other product versions or programming languages are indicated as affected.

The CVSS score of 8.7 classifies the vulnerability as high severity. Because the attack requires only a single network packet and no authentication, the attack vector is likely remote over the Thrift transport. The EPSS score is unavailable and the issue is not listed in the CISA KEV catalog, suggesting no widely known exploitation at present. However, the lack of input validation in the THeader transform allows the server to become unstable when repeatedly triggered, leading to complete service disruption that can affect dependent services.