The flaw is an uncontrolled allocation of resources in Fortinet FortiOS that allows an unauthenticated attacker to perform a slow HTTP denial‑of‑service attack on the web interface by sending crafted HTTP requests that trigger unbounded resource consumption. The weakness is a classical resource exhaustion problem, identified as CWE‑770. The result is loss of availability and potential downtime of the affected device.

The affected firmware is Fortinet FortiOS version 6.4, all releases of 7.0, 7.2, 7.4, and 7.6.0 through 7.6.6. Administrators should verify the current build of each device and plan to upgrade to a version outside these ranges.

The CVSS base score is 5, indicating medium severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is described as an unauthenticated crafted HTTP request over the network, requiring no special privileges, and can be initiated from any IP address that can reach the web interface.