Restbed buffers HTTP request headers without imposing a maximum limit, which allows an unauthenticated remote attacker to exhaust server memory by opening a persistent TCP connection and streaming data indefinitely without sending the header delimiter. This unbounded allocation of heap space can cause the server process to terminate, leading to a denial of service. The weakness is classified as uncontrolled resource consumption (CWE-770).

The Corvusoft Restbed library, specifically all releases through version 5.0.0, is affected. No specific subversions are outlined beyond 5.0.0.

The vulnerability is scored high with a CVSS of 8.7, indicating significant severity. The EPSS score is not available, so the current probability of exploitation cannot be quantified. Restbed is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by spawning a TCP connection to the server and continuously sending header bytes. The absence of authentication and input size validation means the attack requires only basic networking capabilities and can be carried out from the internet or a network where the victim is exposed.