Improper control or validation of file upload sizes in HCL AION can lead to excessive consumption of system resources. The weakness, classified as CWE-400, may cause the application to degrade or become unavailable if an attacker uploads files that exceed acceptable limits or floods the system with large payloads. The documented impact is a potential denial of service rather than direct compromise of confidentiality or integrity.

The vulnerability affects the HCL AION product. No detailed version information is provided, so any deployment of HCL AION should verify whether its installed version is affected by checking release notes or contacting the vendor.

The CVSS score of 1.8 indicates a low severity rating, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker exploiting the upload mechanism by submitting overly large files; this inference is based on the description of the upload size handling issue. No evidence of active exploitation is reported, and the exploitation would require sufficient network reachability to the application and the capability to send large files.