An attacker who can authenticate to an Apache Answer instance can upload a specially crafted TIFF image that causes the server to allocate excessive memory while decoding. This out‑of‑memory condition terminates the server process, resulting in a denial of service. The weakness, classified as CWE‑434, allows an authenticated user to exploit the flaw directly.

Apache Software Foundation’s Apache Answer is affected in all releases through version 2.0.0. Version 2.0.1 contains the fix and is the recommended update target for all installations that can still receive new code pushes.

The vulnerability exhibits a high impact due to the server crash, but it requires authenticated access to the upload feature. The CVSS score of 6.5 and an EPSS score of less than 1% indicate a medium severity with low likelihood of exploitation, and the flaw is not listed in CISA KEV. Once an attacker can upload files, the exploitation path is straightforward: submit a malicious TIFF file, trigger the OOM, and force a process termination. Environments with permissive upload handling or where authenticated users have sufficient privileges to use the file upload interface should treat this as a high‑risk issue.