Technical impact
An uncaught exception in the libevent callback cycle causes the D language implementation of Apache Thrift’s non‑blocking server to terminate, preventing it from accepting further requests. The flaw stems from improper exception handling and resource cleanup, as reflected by the CWE identifiers relating to exception safety, missing documentation, and deallocation errors. A successful trigger removes service availability for any client that can reach the vulnerable server, potentially disrupting critical applications.
Affected Systems
The vulnerability affects all installations of Apache Thrift built before version 0.25.0. This includes any application that incorporates the Thrift D server family, regardless of platform, as long as the affected library is in use.
Risk and Exploitability
The CVSS score of 8.2 classifies the issue as high severity. Although an EPSS score is not currently available and the vulnerability is not listed in CISA KEV, the remote nature of the attack and lack of authentication requirements make exploitation straightforward for an attacker with network access to the Thrift service. If an adversary can reach the server, they can repeatedly invoke the faulty routine to repeatedly trigger the crash and achieve denial of service.
