Good catch — the recursive loop explanation and payload example make this vulnerability very clear. A proper recursion limit or cycle detection is essential to prevent DoS.