The vulnerability stems from an unbounded recursive descent parser in the Drools DRL expression engine that parses deeply nested parenthesised sub‑expressions. When a constraint expression contains approximately 300‑400 levels of nesting, the recursion exhausts the Java thread stack and throws a java.lang.StackOverflowError that propagates out of the parsing call instead of being caught and converted into a DroolsParserException. The resulting exception terminates the parsing operation and can lead to a denial of service for any request that includes such a crafted expression.

Any application that incorporates the org.drools:drools-drl-parser component and allows untrusted users to supply DRL expressions is potentially affected. Specific version information is not provided; the issue applies to all builds of this parser where the unbounded ANTLR grammar is in use.

The CVSS score of 5.3 indicates moderate severity. Exploitation requires an attacker to craft a deeply nested DRL expression and supply it to an application that parses untrusted DRL. Because the vulnerability is limited to denial of service and there is no known remote code execution vector, the risk is primarily availability. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation to date. Nonetheless, any application that accepts user‑supplied DRL expressions should treat this as a legitimate availability risk.