Apache Thrift's JavaME TJsonProtocol/TJSONProtocol accepts JSON strings without bound, allowing an attacker to send arbitrarily large string payloads that will allocate memory without limit. This can exhaust the server's memory, causing crashes or unresponsiveness and correlates with CWE-770.

Vulnerable versions are all Apache Thrift releases prior to 0.25.0. This includes the JavaME bindings distributed by the Apache Software Foundation. The vulnerability applies to any deployment that uses TJsonProtocol/TJSONProtocol in untrusted contexts.

The CVSS score of 8.2 indicates high severity. EPSS is not available, but the lack of a limit means exploitation is theoretically straightforward over a network connection that can transmit large JSON payloads. The vulnerability is not listed in CISA KEV, and no public exploit is reported, yet an attacker can trigger the denial of service by sending large JSON strings from external or internal sources. The likely attack vector is remote or local network access to the Thrift service.