Technical impact
Apache Thrift Lua bindings have a flaw in the TJsonProtocol string and number readers where no size bound is applied and the complexity is quadratic with respect to the input size. This allows an attacker to craft an input that forces the protocol to allocate memory in a rapidly expanding manner, leading to exhaustion of system resources, crashes, and degradation of service. The vulnerability is rooted in improper resource allocation and unsafely handling of unbounded input data, as identified by CWE-407 and CWE-770.
Affected Systems
The issue affects all deployments of Apache Thrift that use the Lua bindings before version 0.25.0. Specifically, any system that processes JSON data through the TJsonProtocol implementation is vulnerable. Users are advised to verify that they are running Thrift 0.25.0 or newer, which contains the fix for this issue.
Risk and Exploitability
The CVSS score of 8.2 classifies this vulnerability as high severity. While no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the lack of bounds presents a clear path for exploitation by sending large JSON inputs over any exposed Thrift endpoint. Such input could trigger quadratic memory usage and lead to a denial of service. The attack vector is inferred to be remote, relying on legitimate access to a Thrift service with the vulnerable bindings.
