The vulnerability is a loop with an unreachable exit condition in the ChangeDomainAction module of datavane/tis. This causes an infinite loop when the affected action is executed, which can exhaust CPU or memory resources and make the application unresponsive. The weakness is categorized as CWE-835, indicating that the program never reaches a termination point during normal operation. The primary impact is a denial of service that can affect all users of the affected instance.

The circular loop originates in the datavane/tis application, specifically before version 4.3.0. Any installations of datavane:tis older than 4.3.0 are susceptible. The affected module resides in the tis-console/src/main/java/com/qlangtech/tis/runtime/module/action directories and is associated with the ChangeDomainAction.Java source file.

The CVSS score for this issue is 10, indicating critical severity. The EPSS score is less than 1%, meaning the likelihood of exploitation is very low at present, and it is not listed in the CISA KEV catalog. The likely attack vector is a user action that triggers the domain change logic, such as submitting a request to the change domain endpoint. An attacker who can invoke this action could force the application into an endless loop, causing service disruption. The low EPSS score suggests that exploitation may not yet be observed in the wild, but the critical severity requires immediate attention.