Uncontrolled Resource Consumption vulnerability in Apache InLong allows ordinary users to create new packages and modify operational configuration or upload non‑official packages. The flaw can enable an attacker to consume server resources, potentially exhausting storage, memory, or processing capacity, and in worst case could allow injection of malicious packages that may compromise data integrity or availability. The weakness is associated with CWE‑400, indicating that the application does not adequately limit resource usage.

The issue affects Apache InLong versions 2.0.0 through 2.3.9. Users running any of these releases are vulnerable until they upgrade. The affected component is the package management API that validates user uploads. The vulnerability is present across all distribution branches of InLong that use the vulnerable package creation logic.

The CVSS base score of 5.3 reflects a moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, indicating limited known exploitation. The attack vector is inferred to be local or within‑infrastructure, where an authenticated or otherwise authorized ordinary user can submit package creation requests. Because the flaw allows resource consumption, an attacker could trigger a denial‑of‑service condition or upload malicious payloads if additional privilege escalations are achieved.