Adobe ColdFusion is vulnerable to uncontrolled resource consumption that can be exploited to exhaust critical system resources such as memory or CPU. The flaw permits an attacker to trigger a denial of service by sending specially crafted requests that consume excessive resources, rendering the application unavailable. The vulnerability does not require user interaction, so any remote actor can potentially activate the failure mode.

The defect impacts all current releases of Adobe ColdFusion 2023 and Adobe ColdFusion 2025. No specific sub-versions were identified in the advisory, meaning every installation of these products that has not received the subsequent patch could be affected.

The CVSS score of 7.5 categorizes the vulnerability as high severity, while the EPSS score of less than 1% indicates a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote network access, informed by the fact that the flaw is triggered by requests sent over the network. The exploitation method is inferred to involve sending crafted input that induces resource exhaustion, such as large request bodies or malformed data that stress the application’s processing logic.