Apache Thrift’s TJSONProtocol accepts a single JSON string or number that exceeds the configured size limit, causing the library to allocate an unbounded amount of memory. This flaw is a classic resource exhaustion vulnerability, classified under CWE‑770. An attacker can deliver an oversized payload to a Thrift service, triggering excessive memory allocation, potential OOM crashes, or slow‑downs that effectively deny legitimate users access to the service.

The issue affects all Apache Thrift bindings—C++, Java, Go, netstd, Python, and Delphi—before version 0.25.0. Any Thrift deployment that relies on these language bindings and has not updated beyond the 0.25.0 release is vulnerable.

The CVSS score of 8.2 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, through an exposed Thrift endpoint that processes a large JSON string or number. Exploitation requires only the ability to send a very large input to the service, making it relatively straightforward for an attacker who can reach the Thrift service.