An unbounded resource allocation vulnerability in HMBRAND DBI::ProfileData allows unauthenticated attackers to cause a denial of service via memory exhaustion.

This flaw is an allocation of resources without limits or throttling, classified under CWE-770, where an unauthenticated remote attacker can supply a large path index in profile dump files to consume available memory.

A successful exploit of this vulnerability results in service unavailability, leading to application crashes and potential disruption of business operations that rely on the affected Perl module. Given the CVSS score of 7.5, which denotes high severity, the risk is significant due to the ease of remote exploitation without requiring any privileges or user interaction.

Immediate Action: Upgrade HMBRAND DBI::ProfileData to version 1.651 or later.

Proactive Monitoring: Monitor application memory usage patterns and error logs for unexpected spikes or crashes related to profile parsing routines.

Compensating Controls: Implement resource quotas and strict input validation at the application boundary if immediate upgrading is not feasible.

Public Exploit Available: false

Given the high severity score and the potential for unauthenticated remote denial of service, administrators must prioritize updating the affected software to version 1.651 or later. Applying the official vendor patch is the only complete method to eliminate the underlying memory exhaustion vector.