The vulnerability in bird‑lg‑go allows an unauthenticated attacker to submit an unbounded JSON payload to the apiHandler (and the similar webHandlerTelegramBot). The Go standard library json decoder reads the entire payload into memory, so a gigantic or endless stream exhausts host RAM and triggers a fatal runtime out‑of‑memory error that terminates the process. The crash is unrecoverable and renders the service unavailable until restarted, constituting a denial of service. The CVSS score of 7.5 indicates a high severity for this issue.

Vendor xddxdd, product bird‑lg‑go. Versions earlier than 1.4.5 are affected; all releases 1.4.5 and later contain the mitigation.

Because the flaw accepts requests without authentication and can be triggered over a single TCP connection, it is straightforward to weaponize. The absence of request size limits means any client can craft a payload large enough to exhaust memory, even from a low‑privilege host. Despite the lack of an EPSS score, the high CVSS assessment and the fact that the vulnerability is publicly documented imply a non‑negligible exploitation risk. The vulnerability is not listed in CISA KEV, but operators should treat it as a significant threat.