CVE-2020-13949

CVE-2020-13949 is a denial-of-service vulnerability affecting Apache Thrift versions 0.9.3 to 0.13.0, as well as several Oracle and Apache products that utilize Thrift. Malicious RPC clients can trigger large memory allocations by sending short messages, leading to a denial of service. With a CVSS score of 7.5 (HIGH), this vulnerability is easily exploitable over the network without authentication or user interaction. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.