CVE-2026-74785
Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption
- State
- Published
- Severity
- 7.1 High
- Published
- Aug 16, 2026
- Updated
- Aug 17, 2026
- Reserved
- Aug 16, 2026
Description
Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attackers who can supply templates can cause out-of-memory exceptions or CPU exhaustion, typically terminating the entire host process.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-400 Uncontrolled Resource Consumption
Affected Products
| Product | Versions |
|---|---|
scribanscriban |
|
References
- GitHub Security Advisory (GHSA-xw6w-9jjh-p9cr)vendor-advisory
- VulnCheck Advisory: Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumptionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.