The vulnerability exists in the /api/info/long_task endpoint of jsbroks COCO Annotator and allows a requester that may not need to be authenticated (this is inferred, as the CVE description does not explicitly state authentication) to trigger a persistent long task that consumes system resources and results in the application becoming unresponsive. It does not grant code execution or data disclosure but can incapacitate the service for legitimate users. The flaw is defined as CWE‑404, indicating an omission of adequate safeguard against function misuse.

Products affected include jsbroks COCO Annotator versions up to and including 0.11.1. Any deployment that exposes the /api/info/long_task endpoint without additional protection is susceptible.

The CVSS score of 6.9 categorizes the issue as medium severity, and the EPSS score is below 1%, reflecting a very low probability of exploitation at the time of analysis. The vulnerability may be exploited remotely; authentication requirement is not specified (inferred that no authentication is required). It is not listed in the CISA KEV catalog, indicating no known widespread attacks yet. The lack of a vendor response makes remediation urgency high for affected installations.