CVE-2026-73062: Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication
Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, causing resource exhaustion and availability degradation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Configure Scriban to enforce LoopLimit so that template execution cannot allocate unbounded memory via the array multiplication operator.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73062?
CVE-2026-73062 has a severity score of 7.5, categorized as high.
How do I fix CVE-2026-73062?
To mitigate CVE-2026-73062, upgrade Scriban to version 7.2.1 or later which addresses the vulnerability.
What type of vulnerability is CVE-2026-73062?
CVE-2026-73062 is a denial of service vulnerability caused by improper handling of memory allocation in array multiplication.
What software is affected by CVE-2026-73062?
The vulnerability impacts Scriban versions 3.0.0 through 7.2.0.
How can an attacker exploit CVE-2026-73062?
An attacker can exploit CVE-2026-73062 by supplying a large integer multiplier in a template, leading to excessive memory allocation.