Apache Thrift PHP bindings expose an uncontrolled recursion flaw in the struct readers generated with the `--gen php:inlined` option and in the `TProtocol::skipBinary` function. Because no recursion‑depth guard exists, a maliciously crafted Thrift payload can trigger an infinite recursive descent, causing a stack overflow or exhausting system resources. The flaw is a classic example of CWE‑674 (Uncontrolled Recursion) and can allow an attacker to crash the Thrift server or client, leading to a denial of service.

The vulnerability affects Apache Thrift implementations from the Apache Software Foundation that are older than version 0.25.0. All releases before 0.25.0 are impacted. Users are advised to upgrade to the 0.25.0 release or later to eliminate the issue.

The CVSS score of 8.2 classifies the flaw as high severity. EPSS data is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the defect by sending specially crafted Thrift messages to a PHP service that uses the vulnerable bindings, which can trigger uncontrolled recursion in the parser and cause a stack overflow, crashing the process and rendering the service unavailable. The flaw requires network access to the Thrift service and does not require privileged local access.