CVE-2020-13949: 
Java vulnerability analysis and mitigation

In Apache Thrift versions 0.9.3 to 0.13.0, a vulnerability was discovered where malicious RPC clients could send short messages that would result in a large memory allocation, potentially leading to denial of service. The vulnerability was assigned identifier CVE-2020-13949 and was publicly disclosed in February 2021 (NVD).

The vulnerability exists in the message processing mechanism of Apache Thrift where malicious clients could exploit the disparity between message size declarations and actual memory allocations. When processing RPC messages, the system would allocate memory based on container size declarations without proper validation, potentially leading to excessive memory consumption (Gentoo Security).

The successful exploitation of this vulnerability could result in a denial of service condition by consuming large amounts of system memory through maliciously crafted RPC messages. This could affect the availability of services using the affected versions of Apache Thrift (NVD).

The vulnerability is remotely exploitable without authentication, allowing malicious RPC clients to trigger large memory allocations by sending specially crafted messages. The attack complexity is considered relatively low as it primarily involves manipulating message size declarations (NVD).

The vulnerability was addressed in Apache Thrift version 0.14.1. Users are strongly recommended to upgrade to this version or later. Multiple projects have released updates to address this vulnerability, including Oracle which included fixes in its July 2021 Critical Patch Update (Oracle Security).

The vulnerability prompted significant response from the open-source community, with multiple major projects such as Apache HBase, Apache Camel, and Apache Druid implementing fixes and releasing security advisories. Various organizations including Oracle and Gentoo released security bulletins and patches to address this vulnerability in their products (Oracle Security, Gentoo Security).