Technical impact
This vulnerability is an inefficient algorithmic complexity flaw in the Perl bindings of Apache Thrift. The [FramedTransport] implementation repeatedly re-slices the remaining buffer on each read and write operation, causing time complexity to grow quadratically with the amount of data processed. An attacker can trigger this behavior by making repeated calls that require large buffers, leading to excessive CPU usage or memory consumption and potentially rendering the service unresponsive.
Affected Systems
The flaw affects Apache Thrift for all versions prior to 0.25.0. The vendor is the Apache Software Foundation and the product is Apache Thrift. Users should ensure they are not running a pre‑0.25.0 release.
Risk and Exploitability
The CVSS score of 8.2 indicates a high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Since the code path uses the public network interface of a Perl Thrift client, the likely attack vector is a remote network attacker sending crafted frames to a vulnerable service. Repeated exploitation would cause the quadratic degradation, effectively leading to a denial of service.
