CVE-2026-74794
Scriban before 6.6.0 Denial of Service via Infinite Recursion
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 16, 2026
- Updated
- Aug 17, 2026
- Reserved
- Aug 16, 2026
Description
Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-674 Uncontrolled Recursion
Affected Products
| Product | Versions |
|---|---|
scribanscriban |
|
References
- GitHub Security Advisory (GHSA-grr9-747v-xvcp)vendor-advisory
- VulnCheck Advisory: Scriban before 6.6.0 Denial of Service via Infinite Recursionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.