The vulnerability arises from an inefficient algorithmic complexity in the PHP bindings of Apache Thrift. When using framed, memory, or HTTP transports, the buffer is re‑sliced on every read, causing a quadratic growth in processing time and memory consumption. An attacker could exploit this by sending specially crafted data to trigger the re‑slicing repeatedly, leading to high CPU load or memory exhaustion and ultimately a denial of service.

This flaw affects all Apache Thrift PHP bindings with a version prior to 0.25.0. The affected vendor is the Apache Software Foundation, and the product is Apache Thrift. Any system running Thrift PHP transports older than 0.25.0 is potentially vulnerable.

The CVSS score for this vulnerability is 8.2, indicating high severity. The EPSS score is not available, but the lack of a KEV listing suggests that there is no current widespread exploitation, though the high complexity makes remote exploitation viable. An attacker can trigger the quadratic algorithm by feeding large or crafted input over the vulnerable transports, consuming server resources. Systems that rely on these transports without mitigations are at risk of denial of service.