An issue exists in HostBill that permits a remote attacker to trigger a denial of service by interacting with the Client Balance component. The weakness falls under CWE-400, which denotes a lack of resource exhaustion controls. When exploited, the service can become unresponsive, affecting the availability of the application for all users.

HostBill versions v.2025-11-24 and v.2025-12-01 are affected. No other product variants are currently listed as impacted. The vulnerability is tied to the Client Balance functionality provided by the HostBill application.

The CVSS score for this issue is 3.8, indicating a moderate severity threat. The EPSS score is less than 1%, suggesting that the likelihood of exploitation is currently very low and there are no known public exploits. The vulnerability is not listed in the CISA KEV catalog, so it is not considered a known exploited vulnerability at this time. Because the functionality is remotely accessible, an attacker could trigger the denial of service by sending crafted requests to the Client Balance endpoint without needing local privileges.