A flaw in the SLE API for Java allows an attacker to send a crafted body length when decoding an ISP1 PDU, causing an unbounded byte array allocation. The lack of an upper bound and the handling of malformed input let an unauthenticated client trigger repeated exceptions and resource leaks, resulting in denial of service. The vulnerability is a classic example of uncontrolled memory allocation.

The issue affects the ESA SLE API for Java (esa:sleapi-j) in all releases prior to version 5.1.7. An attacker can exploit the vulnerability by connecting to the SLE listening service and sending the malicious payloads.

With a CVSS score of 5.3 the vulnerability is moderate in severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote unauthenticated client connecting to the SLE listening service over the network. Once the service receives the malformed or oversized input, it attempts to allocate memory without checking size limits, causing resource exhaustion and ultimately denying service to legitimate users.