The vulnerability arises from improper input validation (CWE-20) in the HTTP parser of TP-Link Tapo C210 v3, C220 v1, and C520WS v2 cameras. When processing requests containing an excessively long URL path, the parser generates an invalid-URL error that leads into cleanup code which assumes the existence of allocated buffers. This assumption is incorrect, causing a crash and subsequent service restart. An unauthenticated attacker can exploit this flaw to repeatedly crash the service or reboot the device, leading to denial of service conditions.

An unauthenticated attacker can cause denial of service by forcing repeated crashes or reboots of affected devices. This disrupts normal device operation and availability but does not indicate code execution or data compromise based on the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Until a fix is available, consider restricting network access to affected devices to trusted sources to reduce exposure.