An unhandled exception occurs when the D language bindings for Apache Thrift receive a truncated HTTP request. The resulting loop has an unreachable exit condition, leading to an infinite loop and an integer underflow, which crashes the server. Because no authentication is required to send the malformed request, an unauthenticated remote attacker can repeatedly crash the service, causing a denial of service. The flaw is limited to the D bindings and is triggered by malformed request data.

The vulnerability is present in the Apache Thrift library for all releases before version 0.25.0, affecting systems that use the D language bindings to handle Thrift requests. Systems running these older Thrift versions are vulnerable regardless of other configurations.

The CVSS score of 8.7 indicates high severity, although the EPSS score is not available and the issue is not listed in CISA’s KEV catalog. The flaw can be exploited remotely by forging a truncated HTTP request, so any environment that exposes the Thrift D server to the network is at risk and could experience repeated crashes and service outages. No authentication or privileged access is needed to trigger the crash, making it a straightforward denial‑of‑service vector.