An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops responding until restart.
Credits
Abhinav Agarwal reported this vulnerability to CISA.
