CVE-2026-74785: Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption
Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attackers who can supply templates can cause out-of-memory exceptions or CPU exhaustion, typically terminating the entire host process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74785?
The severity of CVE-2026-74785 is medium, rated at 6.5.
What type of vulnerability is CVE-2026-74785?
CVE-2026-74785 is a Denial of Service (DoS) vulnerability due to unbounded resource consumption.
How do I fix CVE-2026-74785?
To fix CVE-2026-74785, upgrade Scriban to version 7.0.0 or later.
What software is affected by CVE-2026-74785?
CVE-2026-74785 affects Scriban versions before 7.0.0.
What causes the denial of service in CVE-2026-74785?
The denial of service in CVE-2026-74785 is caused by unbounded string multiplication, uncontrolled BigInteger shifts, and LoopLimit bypassing.