But it's not a given that memory corruption is exploitable as an RCE specifically. I thought to call something an RCE you need a working exploit?
replyPresumably one of Anthropic, Google, or Apache possesses a working exploit, because the official Apache Foundation report on this CVE claims RCE is possible.
replyIsn't resource consumption a DoS?
replyA denial of service is a different class of vulnerability (a minor one, generally).
reply