The vulnerability exists in the Checkout Authentication Flow component of Hostbill and permits a remote attacker, by sending crafted requests, to trigger resource exhaustion that brings the service down. This flaw is classified as CWE-400, indicating that input from an attacker is poorly validated leading to denial‑of‑service. The impact is a loss of availability of the checkout process and potentially the entire billing system while the denial of service is active.

Hostbill. Versions 2025‑11‑24 and 2025‑12‑01 are affected. Any deployment of these versions should be considered at risk until the issue is mitigated.

The CVSS score of 5.3 identifies the vulnerability as moderate severity. The EPSS score of less than 1% shows that, as of now, exploitation is unlikely, and it is not listed in CISA’s KEV catalog. The attack vector is remote and relies on interacting with the checkout authentication flow, so any exposed web interface that processes checkout requests is a potential entry point. Because the exploitation requires sending repeated or malformed requests, the risk is reduced but not negligible for attackers with enough persistence or resources.