Technical impact
The Go implementation of Thrift’s THeaderTransport fails to constrain the decompressed size of a ZLIB frame, allowing an attacker to send a highly compressed payload that expands to a much larger size upon decompression. This data amplification can consume excessive memory or other resources, potentially causing the service to crash or become unavailable. The weakness is classified as CWE‑409, a data size constraint issue.
Affected Systems
Apache Thrift Go bindings before version 0.25.0 are affected. Any Thrift service that exposes THeaderTransport over the network and runs a pre‑0.25.0 Go binding is vulnerable; upgrading to 0.25.0 or later provides the fix.
Risk and Exploitability
With a CVSS score of 8.2 the vulnerability is considered high severity and threatens availability through resource exhaustion. The EPSS score is not available, but the exposure remains network‑based and easily exploitable if the service is openly reachable. The vulnerability is not listed in the CISA KEV catalog. Attackers can craft oversized compressed messages and send them to the Thrift service to trigger the denial‑of‑service impact. No known exploitation exploits or additional privileges are required beyond network access.
