Technical impact
An attacker can send a crafted POST request to the /store/items/search endpoint of the Agent Protocol server and force the service into a state where it can no longer respond to legitimate traffic, effectively disrupting availability. This vulnerability is an instance of uncontrolled resource consumption as defined by CWE-400 and can lead to a complete denial of service on the affected system.
Affected Systems
The affected component is the Agent Protocol server, but the vendor and specific product names are not listed in the available data. No version or configuration details are provided, so the scope of affected infrastructure remains unclear beyond the presence of the /store/items/search endpoint.
Risk and Exploitability
The vulnerability carries a CVSS score of 7.5, indicating a high severity and a significant impact on service availability. The EPSS score is not available, so the current probability of exploitation cannot be quantified. It is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild yet. The attack can be performed remotely with a crafted POST request; authentication requirements are not specified, so it is inferred that the request may be unauthenticated or that minimal credentials are required.
