This vulnerability arises when the Ruby bindings of Apache Thrift's JSON protocol accept a string with no predefined size limit, allowing the allocation of an unbounded amount of memory. An attacker who can control the input to the protocol can trigger the protocol to allocate an arbitrarily large buffer, leading to excessive memory consumption and potentially exhausting system resources. The impact is primarily a denial‑of‑service condition, where legitimate requests may fail or the service may crash due to resource exhaustion. The weakness is identified as CWE-770, describing out‑of‑bounds resource allocation.

The affected software is the Apache Thrift library from the Apache Software Foundation, specifically the Ruby bindings used in versions prior to 0.25.0. Any system that integrates Apache Thrift Ruby and exposes the JSON protocol to untrusted input is potentially vulnerable. The issue does not affect newer releases of Thrift (0.25.0 and later).

With a CVSS score of 8.2, this vulnerability is considered high severity. The EPSS score is not available, but the lack of a hard limit means that an attacker could readily exploit the flaw by sending oversized JSON payloads. The attack vector is likely remote, provided the Thrift service is exposed over a network, or local if the malicious input comes from a trusted process. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation at this time, though its high impact warrants immediate attention.