The vulnerability is an uncontrolled recursion in the Samsung Open Source Escargot engine, which allows attackers to trigger excessive memory allocation. This can exhaust system resources and ultimately result in a denial of service condition. It is classified as CWE‑674, representing unchecked recursion that leads to resource exhaustion.

The affected product is Samsung Open Source Escargot, specifically the code referenced by commit hash 590345cc6258317c5da850d846ce6baaf2afc2d3. Any deployment of Escargot that includes this commit is susceptible unless patched.

The CVSS score of 5.5 indicates a moderate severity, but the lack of an EPSS score and absence from the CISA KEV catalog suggest limited known exploitation. The attack vector is inferred to involve sending crafted input or scripts that trigger recursion, leading to resource exhaustion. Administrators should treat this as a risk to availability when Escargot processes untrusted input and implement remediation accordingly.