Technical impact
The C++ implementation of Apache Thrift’s THeaderTransport does not enforce the configured maxFrameSize value, causing the library to allocate memory for an incoming request before rejecting it. An attacker can therefore send a request larger than the intended frame size and trigger the allocation of an excessive amount of memory or other system resources, which can exhaust those resources and result in a denial of service. The flaw is a resource exhaustion weakness, classified as CWE-409 and CWE-770, and it primarily impacts availability without directly compromising confidentiality or integrity.
Affected Systems
This vulnerability is present in all Apache Thrift releases prior to version 0.25.0, affecting the C++ bindings that use THeaderTransport. Any deployment of Thrift before that version that does not apply the vendor patch is susceptible. The affected product is Apache Thrift released by the Apache Software Foundation.
Risk and Exploitability
The vulnerability has a CVSS score of 6.9, indicating moderate to high severity. The EPSS score is not available, meaning there is insufficient data on the likelihood of exploitation in the wild. The issue is not listed in the CISA KEV catalog, further suggesting that widespread exploitation is not known. The attack vector is likely remote, as an attacker can trigger the flaw by sending specially crafted requests over the network to a Thrift service.
