The flaw resides in the toc_transformer function within PageIndex. An attacker can supply crafted input that causes an infinite loop during PDF Table of Contents handling, exhausting CPU resources and potentially crashing the service. This attack is a pure availability violation and is triggered by remote input. The CWEs referenced are 404 (Missing Resource) and 835 (Infinite Loop).

VectifyAI:PageIndex is affected. No discrete version numbers are supplied because the project uses a rolling release model; the vulnerability exists in any code prior to the commit f50e52975313c6716c02b20a119577a1929decba.

The CVSS score of 6.9 indicates moderate severity. The exploit is publicly available, which increases risk; however, no EPSS score is reported, and the vulnerability is not in the CISA KEV catalog. The attack vector is inferred to be remote, as the description states that it may be launched remotely. An attacker would need network access to the component that processes PDFs to trigger the loop.