A null pointer dereference has been identified in the oatpp::data::type::ObjectWrapper constructor. The flaw can be triggered by supplying a null value to the constructor, leading to an application crash. The crash can disrupt service availability, effectively causing a denial‑of‑service condition. The vulnerability is a classic example of a null pointer dereference (CWE‑476) that, while not escalating privileges, compromises integrity of service continuity.

The affected product is oatpp, with versions up to and including 1.3.1 vulnerable. No other vendors or product lines are listed. If you are running oatpp in any capacity, verify your installed version and whether your deployment may encounter the null‑pointer scenario highlighted in Type.hpp.

The CVSS score of 4.8 signals moderate severity, and the EPSS score of less than 1% indicates a very low probability of widespread exploitation. The flaw requires local access and does not feature in the CISA KEV catalog, meaning no confirmed public exploits are known. An attacker with local privileges could invoke the vulnerable constructor and cause the application to crash, but remote exploitation or privilege escalation is not supported by the current data.