This vulnerability exists in aiwaves-cn agents up to commit e8c4e3c2d19739d3dff59e577d1c97090cc15f59, specifically in the recall_relevant_memories_to_working_memory function of core/cat/looking_glass/stray_cat.py in the cheshire_cat_core component. The issue causes excessive resource consumption, potentially leading to denial of service conditions. The vulnerability is remotely exploitable without privileges or user interaction. The project has not yet issued a fix or official remediation guidance, and the rolling release nature means no fixed version is currently identified. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation can cause resource exhaustion on affected systems, potentially leading to degraded performance or denial of service. Since the vulnerability can be triggered remotely without authentication, it poses a risk to availability. No evidence of active exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the project. Until a fix is released, consider implementing network-level protections to limit exposure of the affected component to untrusted sources.