Vulnerability‑Lookup 5.5.1 through 6.4.1 permits a signed‑in user to cause the server to allocate excessive memory when rendering webhook payload templates. Each template placeholder’s format specifier is passed directly to Python’s string formatting, allowing a user to craft a payload such as {title:>999999999}. When the notification form runs a test render, this produces an output roughly 1 GB in size, and repeating fields multiplies that cost. The notification daemon recreates the expanded string on every webhook delivery, so the memory consumption can grow rapidly. In deeply nested templates the process can end with an unhandled recursion error and a 500 response.

The affected product is the Vulnerability‑Lookup web application, version 5.5.1 up to but excluding 6.4.1. Any account with user authentication, which the default configuration permits after e‑mail confirmation, can exploit the flaw. The latest released fix, 6.4.1, caps all numeric values in format specifiers to 256, limits a rendered template to 1,000,000 characters on save and delivery, and rejects templates nested deeper than 32 levels.

With a CVSS score of 5.3, the vulnerability is of moderate severity. There is no EPSS data and the issue is not currently listed in CISA KEV, but the condition that an attacker only needs an account and that the server may consume gigabytes of RAM indicates a realistic denial‑of‑service risk. Because the exploit is authenticated, attackers can create a new account via the default registration flow and then launch the exploit from the web interface or via the notification daemon.