A critical integer overflow vulnerability in the Apache Thrift TFramedTransport component allows unauthenticated remote attackers to trigger a denial of service.

The vulnerability is an integer overflow or wraparound (CWE-190) within the TFramedTransport Go language implementation. It is an unauthenticated, network-accessible flaw that can cause system instability or service disruption.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk due to the ease of exploitation. Successful exploitation can lead to a denial of service, rendering the affected application unavailable to legitimate users. This poses a significant risk to business continuity, especially for services relying on the Thrift framework for high-performance communication.

Immediate Action: Upgrade the Apache Thrift Go package to version 0.23.0 or later to resolve the integer overflow flaw.

Proactive Monitoring: Monitor server logs for unusual traffic patterns or frequent service crashes that may indicate exploitation attempts targeting the Thrift transport layer.

Compensating Controls: Implement rate limiting and network-level filtering to restrict traffic to known-good sources, which may reduce the exposure to malformed frames designed to trigger this overflow.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the potential for service disruption, organizations using Apache Thrift in Go environments should prioritize this update. Applying the patch to version 0.23.0 is the only reliable way to mitigate the risk of denial of service attacks targeting this specific implementation flaw.