Apache Thrift has a flaw where an unbounded size field can cause the runtime to request more memory than is actually available, resulting in excessive allocation or failure. The issue spans multiple language bindings—Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D—making it broadly applicable across environments that deploy Thrift services. According to the CVE entry, the weakness is identified as CWE‑770 (Information Exposure through Resource Exhaustion) and CWE‑789 (Uncontrolled Resource Consumption). An attacker who can influence the size value fed to Thrift can force the process to consume large amounts of RAM, potentially crashing the service or degrading overall system performance.

The vulnerability affects any installation of Apache Thrift prior to version 0.25.0, regardless of the programming language in which the Thrift bindings are compiled. This includes all released Thrift packages that ship the Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin or D language libraries.

The overall CVSS score is 8.7, indicating a high severity risk. No EPSS score is available, and the issue is not listed in CISA KEV. The attack vector is inferred to be remote, as the flaw lies in processing messages received over the Thrift transport interface. An adversary who can provoke large allocation requests—such as by sending a specially crafted request from a client or a compromised internal system—can trigger memory exhaustion, leading to denial of service or, in resource‑constrained environments, a system crash.