The vulnerability resides in the JsonSanitizer.sanitize() method of OWASP json-sanitizer version 1.2.3. A specifically crafted JSON payload can trigger the sanitizer to consume excessive resources, leading to a denial‑of‑service condition. This weakness is a classic example of uncontrolled resource consumption (CWE‑770), where an attacker supplies input that forces the application to expend significant processing time or memory. The result is an interruption of service for legitimate users or potential crash of the application if resources become exhausted.

Applications that incorporate OWASP json-sanitizer v1.2.3 for parsing or sanitizing JSON input are affected. The issue has been reported against that exact library version; applications that use later releases or alternate JSON handling mechanisms are not affected unless they rely on this deprecated implementation.

The CVSS score is 7.5, reflecting a high severity denial‑of‑service risk. The EPSS score is unavailable, so current evidence of exploitation is limited. Use of the vulnerable component could expose the application to a denial‑of‑service attack if an adversary can feed malformed JSON, either through a public API or an internal interface. The likely attack vector is remote delivery of a crafted JSON payload to any exposed endpoint that passes input to JsonSanitizer.sanitize()