A denial-of-service vulnerability in Pandora's handling of DAA files allows unauthenticated attackers to crash the application by submitting malicious file payloads.

The application improperly handles DAA (Direct Access Archive) files, which leads to a denial-of-service condition. This is classified as an unrestricted upload or processing issue (CWE-434) where malformed input can exhaust system resources or cause application instability.

Successful exploitation causes service disruption, which can halt security analysis pipelines and prevent timely threat detection. With a CVSS score of 8.7, this represents a high risk to operational availability and the continuity of security operations.

Immediate Action: Monitor the official GitHub repository for a release version following 1.12.5 that incorporates the fix referenced in commit f4294a873f86fbf2569c289e329fff2f52ca50c9.

Proactive Monitoring: Monitor system resource usage and application logs for crashes or unexpected termination when processing archive files.

Compensating Controls: Implement file type validation and strict upload size limits at the network perimeter or application ingestion layer to prevent the processing of untrusted DAA files.

Public Exploit Available: Unknown

Users of the Pandora analysis tool should restrict the processing of untrusted DAA files until a formal patch is released. Ensure that your security team is tracking the upstream repository for the inclusion of the referenced fix.