CVE-2026-73060CWE-770denial-of-service

CVE-2026-73060

High · published August 16, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU cores and exhausting garbage collection resources even when LoopLimit is set to 1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00452 · 38.3th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-08-16T18:16Z
References (5)
https://github.com/scriban/scriban/commit/205ca6a7c2349d3d388bd5f1f7729ee198c0d5e5 · [email protected]https://github.com/scriban/scriban/commit/c3f03bfc912e14b306a01a03e611f606b05f9c33 · [email protected]https://github.com/scriban/scriban/security/advisories/GHSA-89cf-6hmv-8rxm · [email protected]https://www.vulncheck.com/advisories/scriban-through-denial-of-service-via-scriptrange-multiply · [email protected]https://github.com/scriban/scriban/security/advisories/GHSA-89cf-6hmv-8rxm · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 16 AUG 13:14Z
    Scriban 3.0.0 through 7.2.5 Denial of Service via ScriptRange.Multiply
    cvelistv5