CVE-2026-73062highCWE-770

CVE-2026-73062: falha de alta gravidade em scriban

Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar scriban+ Monitorar Scriban

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.5%
Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, causing resource exhaustion and availability degradation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
scriban · scriban
CVEs relacionadas — scriban

No mesmo produto, das mais perigosas para as menos.

CVE-2026-74789HIGHScriban before 7.0.0 LoopLimit Bypass via Built-in OperationsEPSS 0.6%CVE-2026-74795HIGHScriban before 6.6.0 Denial of Service via Uncontrolled RecursionEPSS 0.6%CVE-2026-74792HIGHScriban before 7.0.0 Stack Overflow via nested array initializersEPSS 0.5%CVE-2026-74794HIGHScriban before 6.6.0 Denial of Service via Infinite RecursionEPSS 0.5%CVE-2026-74788HIGHScriban before 7.0.0 Denial of Service via string.pad_left/pad_rightEPSS 0.5%CVE-2026-74787HIGHScriban before 7.0.0 Uncontrolled Recursion via object.to_jsonEPSS 0.5%