The vulnerability resides in the formatString function of the a2ui Parser component, which allows an attacker to manipulate input strings in a way that causes excessive consumption of system resources. This leads to high CPU or memory usage that can degrade performance or cause service interruption for legitimate users. The weakness is represented by CWE-400 and CWE-404, indicating uncontrolled resource consumption and improper resource shutdown.

Vendors affected are a2ui-project a2ui, with versions up to and including 0.10.6 vulnerable. The fix is available in the commit identified by 1f71d1aac1b145ef57c7526f9e0cff316f5934e2. No additional affected releases are listed.

The CVSS score of 5.1 classifies the issue as moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploits currently. However, the attack can be initiated remotely and has been publicly disclosed, indicating that exploitation is possible if an attacker can feed crafted input to the Parser. Given the remote initiation and public availability of the exploit, administrators should treat the vulnerability as a realistic risk to service availability.