An authenticated Plone user is able to create content items with excessively long titles, descriptions, or filenames. The resulting storage or processing overhead causes Plone to become unresponsive and makes the problematic content difficult to edit or delete. This is a denial‑of‑service vulnerability rooted in improper input size validation (CWE‑400).

Affected products are plone.app.dexterity and plone.app.contenttypes. The vulnerability exists in plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and in plone.app.contenttypes versions through 3.0.11, 4.0.0 through 4.0.9, and 5.0.0.

The CVSS score is 6.5, indicating moderate severity. EPSS is unavailable so the exploitation likelihood is unknown and the vulnerability is not listed in CISA KEV. The attack requires an authenticated user with content creation rights, so it is not a remote unauthenticated vector. While the exploit does not immediately compromise confidentiality or integrity, repeated usage can degrade service availability and hinder content management.