The vulnerability originates from a loop with an unreachable exit condition in the jsonrpc4j library, classified as CWE-835. When triggered, the loop runs indefinitely, consuming CPU resources and preventing the application from processing further requests, effectively causing a denial of service. The publisher labels it as a buffer overflow, but the underlying flaw is an infinite loop rather than a memory corruption issue.

The affected product is jsonrpc4j from briandilley, version 1.6.0 and earlier. Projects that embed this version and expose the JSON‑RPC endpoint may be vulnerable if proper access controls are not in place.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is below 1 %, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector would be remote, via crafted inbound requests to the JSON‑RPC service, though this is inferred from the nature of the library and not explicitly stated in the advisory. Exploitation would require an attacker to send data that triggers the loop, resulting in the service becoming unresponsive until it is restarted or a watchdog recovers it.