Tandoor Recipes, a recipe management application, contains a flaw in its recipe import feature that permits a denial‑of‑service condition. An authenticated user can upload a ZIP archive that is vastly larger than the target system’s capacity, triggering resource exhaustion and causing the server to crash or become heavily degraded.

The vulnerability affects TandoorRecipes:recipes prior to version 2.6.5. All installations running any version earlier than 2.6.5 are potentially exposed. The fix is included in version 2.6.5 and newer.

In the CVE record the CVSS score is 6.5, indicating a moderate to high impact, while the EPSS score is below 1 percent, suggesting a low likelihood of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires legitimate access to the import functionality; the attack vector is likely authenticated user access. The result is service disruption to all users of the affected instance.