Apache Thrift libraries for Lua contain an inefficiency where the `TFramedTransport` and `THttpTransport` classes re‑slice the same buffer on every read operation, producing a quadratic time complexity. This behavior can cause an attacker to force an application to perform excessive CPU work, leading to a denial of service. The weakness is identified as CWE‑407, which relates to algorithmic complexity error.

All installations of Apache Thrift that use the Lua binding and run a version earlier than 0.25.0 are affected. The vulnerability applies to both framed and HTTP transport mechanisms used by the Lua module, regardless of the host operating system or network environment.

The problem is rated with a CVSS score of 8.7, indicating a high severity. No EPSS score is currently publicly available, and the vulnerability is not listed in the CISA KEV catalog. Because it is triggered by network traffic that forces the transport classes to process large buffers, the most likely attack vector is remote access through the service’s network interface. An exploiter would send crafted packets to an exposed Thrift endpoint, overloading the CPU and potentially causing legitimate requests to fail.