The Apache Thrift Rust crate versions prior to 0.23.0 contain a vulnerability in the TBinaryInputProtocol's read_bytes function, where an attacker-controlled 4-byte length value is used directly to allocate a buffer without bounds checking. This can lead to excessive memory allocation or immediate process abort, causing a denial of service. The issue affects any peer sending binary protocol data and is unauthenticated and network-reachable. The vulnerability is fixed in version 0.23.0 by adding checks against negative sizes and enforcing a maximum string size limit.