The flaw lets a user call the cancel pull operation on another user’s Flatpak pull request. The operation removes the request from internal bookkeeping but does not truly terminate the download or installation. The requesting user retains no control over the ongoing pull, while the target user continues pulling resources without a way to stop it. This creates a denial‑of‑service condition for the target user, allowing the caller to exhaust local storage or network bandwidth.

The vulnerability affects the Flatpak system helper component bundled with Red Hat Enterprise Linux 7, 8, 9, and 10. All installations that rely on the default Red Hat Flatpak packages are vulnerable until the vendor releases a patched version.

The CVSS score of 3.3 reflects the limited impact and lack of remote exploitation. The EPSS score is not available, and the issue is not listed in KEV. The likely attack vector is local execution; a user or process with access to the Flatpak D‑Bus interface can invoke the cancellation on another user’s request. Because the flaw does not affect authentication or privilege escalation and offers only service interference, the overall risk is low. Nevertheless, the inconvenience for users justifies applying the vendor’s fix promptly.