Technical impact
This flaw occurs when the TEvhttpServer component of Apache Thrift leaks its RequestContext after a processor throws an exception before the callback is invoked. The missing release of memory after the object's effective lifetime can lead to uncontrolled memory consumption, potentially exhausting the server’s memory. The vulnerability is an instance of improper resource deallocation (CWE‑401). No explicit authentication or privileged access is required; an attacker can trigger the exception path through crafted client requests, making the impact primarily a form of denial of service via memory exhaustion.
Affected Systems
Apache Thrift before version 0.25.0, distributed by the Apache Software Foundation.
Risk and Exploitability
The CVSS score is 6.3, indicating moderate severity. The EPSS score is not available, so the precise probability of exploitation is uncertain, yet it has not been listed in the CISA KEV catalog. The most likely attack vector is remote, with an attacker sending malicious requests to the Thrift service to trigger the exception path, leading to a memory leak and potential resource exhaustion.
