Uncontrolled resource consumption, a vulnerability classified as CWE-400, in Microsoft SQL Server allows an authorized attacker to deny service across the network. The flaw enables the attacker to consume processing or memory resources to a level that causes a service interruption or severely degrades performance, impacting all client connections that rely on the database instance.

The vulnerability affects Microsoft SQL Server 2022 (GDR), Microsoft SQL Server 2022 for x64-based systems (CU27), Microsoft SQL Server 2025 for x64-based systems (CU9), and Microsoft SQL Server 2025 for x64-based systems (GDR).

The CVSS score of 6.5 classifies this as a medium severity vulnerability. With an EPSS score of less than 1% and no listing in the CISA KEV catalog, exploitation likelihood is currently low, but potential exists for a local or authenticated attacker to execute the attack path. Based on the information, it is inferred that the attacker would need to issue SQL commands that trigger excessive resource consumption, which places the opportunity for exploitation in the domain of authorized or privileged users within the network.