Apache Thrift's TZlibTransport incorrectly enforces its decompressed-size limit once the limit is exactly reached, allowing a malicious client to deliver a highly compressed payload that bypasses the size check and forces the server to decompress data larger than intended. This leads to excessive resource consumption and can crash the service, representing a high-impact denial of service.

The flaw exists in all releases of Apache Thrift before version 0.25.0. Users running the Python bindings of Thrift with TZlibTransport in these older versions are vulnerable and should verify their installation against the specific pre‑0.25.0 releases.

The CVSS score of 8.2 signals high severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, yet it remains exploitable from a network-facing Thrift service. An attacker can send a crafted compressed packet to trigger memory exhaustion or a crash; however, no public exploits have been reported to date.