The vulnerability resides in the Ruby SimpleServer implementation of Apache Thrift. It fails to catch non-Transport/Protocol exceptions, causing the serve() method to terminate when such an exception occurs. This interruption stops the server from handling subsequent requests, leading to a denial of service. The weakness originates from improper handling of exceptional conditions (CWE-248) and the absence of a watchdog loop (CWE-755).

Apache Thrift Ruby bindings from the Apache Software Foundation, versions prior to 0.25.0. Any Ruby application that uses these bindings and exposes a SimpleServer is potentially affected.

The CVSS score of 8.7 classifies this as high severity. Although exploitation probability evidence (EPSS) is not available, the lack of a KEV listing does not diminish the risk for active deployments. Based on the description, it is inferred that the likely attack vector is remote: an adversary can send a malformed or malicious RPC that triggers a non-Transport/Protocol exception, forcing the server to exit the serve loop and cease responding to clients. This results in loss of availability for any service relying on the affected server.