In Apache Thrift dart bindings, the TJsonProtocol/TJSONProtocol implementation allows strings of arbitrarily large size. An attacker can send a payload containing an excessively long string, causing the server to allocate memory without restraint, potentially exhausting resources. This weakness falls under CWE-770, describing uncontrolled resource consumption. The primary impact is a denial of service where the application or system may become unresponsive or crash due to memory exhaustion.

The vulnerability affects Apache Thrift from the Apache Software Foundation, specifically all releases prior to 0.25.0. The issue exists in the Dart bindings of Thrift where the TJsonProtocol/TJSONProtocol component lacks an upper bound on string length. No OS or deployment-specific constraints are listed, so any environment running a vulnerable Thrift Dart server is potentially affected.

The CVSS score of 8.2 indicates high severity, and the vulnerability is not currently listed in CISA KEV. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified, but the lack of input size limits invites resource exhaustion attacks when the Thrift service is exposed to untrusted input. The inferred attack vector is remote, depending on the exposure of the Thrift service over the network. If the service is not publicly reachable, the risk is lower, but any internal or external exposure that allows crafting large JSON payloads could lead to service disruption.