The vulnerability lies in the XML parsing logic of OpenNMS Meridian and Horizon. An XML document that declares a DOCTYPE with internal entities can be crafted to cause a large amount of entity expansion, consuming megabytes of memory on the server. An authenticated user with provisioning access can upload such a document through a requisition or foreign‑source import, which the server fetches and parses. The resulting memory exhaustion renders the OpenNMS service unresponsive, leading to a denial of service. The weakness is classified as Resource Exhaustion (CWE‑400) and can also involve poor exception handling or input validation (CWE‑776).

All versions of OpenNMS Meridian and Horizon supplied by The OpenNMS Group are affected until the releases Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or later. Any installation that has not applied these updates remains vulnerable.

Given the CVSS score of 6.5, the vulnerability is considered moderate in severity, and the EPSS score of less than 1% indicates that automated exploitation is unlikely. The attack requires an authenticated provisioning account, so an insider or a threat actor who has compromised an internal user account could trigger the denial of service. Since the software is intended for private network deployment, the risk is elevated if the service is exposed to the internet, but the vulnerability is not listed in CISA’s KEV catalog.