An infinite loop occurs in the C GLib bindings for Apache Thrift when the underlying read operation returns zero bytes; the read_all function repeatedly spins, depleting CPU resources and causing a denial of service. The weakness is classified as CWE-835, reflecting a loop with an unreachable exit.

Apache Thrift releases before version 0.25.0 are affected. The vulnerability exists in the c_glib binding layer of the library and applies to any deployment that links against those older Apache Thrift binaries.

The CVSS score of 8.2 indicates high severity, but no EPSS data is currently available and the issue is not listed in CISA’s KEV catalog. Exploitation would require the ability to interact with a Thrift service that uses the vulnerable c_glib bindings, delivering input that triggers a zero‑byte read. The resultant denial of service could be achieved by a remote attacker with network access to the Thrift endpoint or by a local attacker who can influence the data stream to the binding.