The vulnerability is a stack overflow caused by excessive recursion in the curl_mime_free function of the libcurl library. An attacker can supply deeply nested MIME structures that trigger repeated cleanup calls, exhausting stack memory and crashing the application. The weakness is identified as CWE‑674, which represents Uncontrolled Recursion.

All software that links against libcurl and processes user‑supplied MIME content is affected. No specific vendor or product list is provided, but any application that accepts multipart MIME messages through libcurl is potentially impacted.

The CVSS score of 3.7 indicates a low overall severity for the flaw, and EPSS is not available. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is network‑based delivery of malicious MIME data to a target application that utilizes libcurl for cleanup. Attack prerequisites would include the ability to send a specially crafted MIME payload to the vulnerable application. The low CVSS score reflects the impact as a denial of service rather than data exposure or privilege escalation. The lack of a KEV listing suggests there are no widely reported exploitation incidents at this time.