The vulnerability in Apache Thrift Go bindings involves uncontrolled recursion when reading frames with no payload bytes. Both Go transports read out a buffered frame and, if the frame yields no payload bytes, they recursively call Read instead of looping. A peer can produce such frames with zero declared size or a header block that fills the frame, causing unbounded recursion. This leads to the Go runtime stack limit being exceeded, causing a fatal error that crashes the process. The issue affects Apache Thrift versions before 0.25.0 and is resolved in version 0.25.0.

Exploitation of this vulnerability causes the affected Apache Thrift Go process to crash due to a fatal stack overflow error. This results in denial of service as the process terminates unexpectedly. There is no indication of code execution or data compromise from the provided information.

Users should upgrade Apache Thrift to version 0.25.0 or later, where this uncontrolled recursion issue is fixed. No other mitigation is indicated or required according to the vendor advisory.