Security vulnerability or not, it's still a DOS. Imagine having just a few requests (like less than 10) to your site consume 100% CPU until the server process is killed or restarted.