This vulnerability is an uncontrolled resource consumption (CWE-400) and improper resource limitation (CWE-770) issue in the e-mail handling functionality of OTRS. When exploited, it allows an attacker with limited privileges and requiring user interaction to cause excessive resource allocation, leading to denial of service by aborting the webserver. The vulnerability affects multiple major versions of OTRS up to but not including 2026.4.x. No known exploits are reported in the wild, and no vendor advisory or patch is currently available.

The primary impact is denial of service due to the webserver aborting from excessive resource consumption triggered by the e-mail handling process. There is no reported confidentiality or integrity impact. The CVSS score of 5.7 reflects a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and causing availability impact only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor for unusual resource usage related to OTRS e-mail handling and consider applying temporary controls such as rate limiting or resource quotas if feasible. No vendor-provided mitigation or temporary fix is currently documented.