A malformed ZIP file read by the SonarQubeParser or MSDefenderParser parser module can cause an out‑of‑memory condition, leading to a denial of service. The flaw is a result of unchecked input size and missing error handling, consistent with CWE‑1284 and CWE‑404. An attacker can exploit the vulnerability remotely by delivering a crafted ZIP archive, potentially exhausting system resources and interrupting the DefectDojo service.

The vulnerability exists in OWASP DefectDojo versions up to and including 2.55.4. It is present in the SonarQubeParser and MSDefenderParser components. The issue has been resolved in version 2.56.0. Administrators should review their installed DefectDojo release and upgrade if the affected components are deployed.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, yet the presence of a public exploit means that exposed installations could be targeted. Attackers can trigger the denial of service remotely by uploading a specially crafted ZIP archive to the vulnerable parser endpoint; no authentication is required for the attack vector to succeed, meaning any accessible instance is at risk.