A high severity data amplification vulnerability in Apache Thrift allows remote, unauthenticated attackers to cause a denial of service by exploiting improper handling of compressed data.

This vulnerability involves the improper handling of highly compressed data (CWE-409) in C++, Java, Python, Go, D, and C/GLib bindings, allowing unauthenticated remote attackers to induce a data amplification state that crashes or hangs the service.

The ability to trigger high resource consumption remotely poses a severe risk to service availability and system stability. Given the CVSS score of 8.7, this vulnerability could result in substantial downtime and operational disruption if left unpatched, as it does not require authentication to trigger.

Immediate Action: Update Apache Thrift to version 0.24.0 or later to implement proper constraints on compressed data processing.

Proactive Monitoring: Review system logs for unusual memory allocation patterns or crashes associated with Thrift service processes.

Compensating Controls: Deploy Web Application Firewalls or deep packet inspection tools to identify and block traffic containing excessively large or highly compressed payloads.

Public Exploit Available: false

Given the high impact on system availability, patching to version 0.24.0 is mandatory for all affected environments. Administrators should treat this as a high priority maintenance task to ensure that services remain resilient against remote denial of service attempts.