An unauthenticated remote attacker can trigger the csaf_provider component to allocate resources without limits or throttling via a weakness classified as uncontrolled resource consumption (CWE-770). The attacker can repeatedly send requests that force the system to consume CPU cycles, quickly exhausting available processing capacity. This high CPU load leads to a denial of service, preventing legitimate users from accessing the affected service.

Both the gocsaf development community and its csaf_provider product are affected. All releases of csaf_provider lack resource limits and are vulnerable until a fix is released. Because no specific versions are listed, it is prudent to treat all releases of csaf_provider as susceptible unless an official announcement indicates otherwise.

The vulnerability has a CVSS score of 8.7, indicating high severity. EPSS data is unavailable, but the lack of exploitation evidence does not negate the risk, particularly for publicly exposed instances. The remote nature of the flaw allows an attacker to initiate the denial of service without authentication, over a network. The vulnerability is not yet listed in CISA KEV, yet its ability to exhaust CPU resources warrants close monitoring for emerging exploits.