The flaw is in the PHP 'thrift_protocol' accelerator of Apache Thrift, which fails to validate the quantity of data in zero‑byte container elements. Because the code accepts and processes these objects without enforcing limits, an attacker can send requests that force the server to allocate an arbitrarily large amount of memory or to iterate excessively over the data. The result is exhaustion of critical system resources, causing the Thrift handling process or the entire application to crash or become unresponsive.

Apache Thrift PHP bindings versions earlier than 0.25.0 using the 'thrift_protocol' accelerator are vulnerable. Any deployment that exposes the Thrift API over PHP, especially those that have not applied the 0.25.0 update, is at risk.

The CVSS base score of 8.7 classifies this as a high‑severity vulnerability. The attack vector is remote, requires no authentication, and can be initiated by sending crafted data to the Thrift endpoint. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating no public exploitation reports yet; however, the absence of input validation makes exploitation straightforward for a motivated attacker.