The vulnerability lies in the recall_relevant_memories_to_working_memory function of stray_cat.py within cheshire_cat_core. A crafted input can force the function to consume excessive resources, potentially leading to denial of service. The documented Remote Exploitation indicator suggests an attacker can trigger the flaw over the network. This weakness is identified as resource exhaustion (CWE‑400) and missing resource handling (CWE‑404).

The affected product is aiwaves‑cn agents, specifically changes up to commit e8c4e3c2d19739d3dff59e577d1c97090cc15f59. Because the project follows a rolling release model, no specific version numbers are listed, so users should treat the current release as potentially vulnerable until a fix is released.

With a CVSS score of 6.9 the flaw is considered moderate severity. The EPSS score is not available, so the exploitation likelihood cannot be quantified beyond the public availability of the exploit code. The vulnerability is not listed in CISA KEV. An attacker with remote access to the agents service could manipulate the input to the recall function, causing excessive CPU or memory usage and potentially disrupting the service.