The vulnerability arises from the server's inability to handle excessive characters appended to multipart boundaries. When an attacker sends a malformed multipart request with arbitrary characters at the end of the boundary, the server processes each extra character in an infinite loop. This leads to excessive resource consumption, causing the server to become unresponsive and resulting in a denial of service (DoS) for all users. The exploit does not require authentication, making it easy for attackers to execute.

An attacker crafts a multipart request with a boundary that includes a large number of appended characters. The attacker sends this request to the server, which then enters an infinite loop processing the extra characters. This consumes server resources, eventually causing the server to become unresponsive and denying service to legitimate users.

All users of the affected version (Release v0.2.36) are impacted, as the vulnerability can be exploited without authentication. This includes any deployment of the software that is accessible over the network.