CVE-2026-67199

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large iteration count in an expression column evaluated once per table row, causing the Tornado IOLoop to block without any iteration cap, deadline, or cancellation check, rendering the server unresponsive to all connected clients.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://christbowel.com/blog/perspective-5-0-0-five-cves/
https://www.vulncheck.com/advisories/perspective-dos-via-loop-expression-evaluation
https://christbowel.com/blog/perspective-5-0-0-five-cves/

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Perspective 5.0.0 contiene una vulnerabilidad de denegación de servicio que permite a atacantes remotos bloquear el bucle de eventos del servidor indefinidamente al enviar una expresión manipulada que contiene construcciones de bucle for o while ilimitadas en un mensaje TableMakeViewReq. Los atacantes pueden incrustar un recuento de iteraciones arbitrariamente grande en una columna de expresión evaluada una vez por fila de tabla, haciendo que el Tornado IOLoop se bloquee sin ningún límite de iteración, fecha límite o verificación de cancelación, dejando al servidor sin respuesta para todos los clientes conectados.

Information

Published : 2026-08-04 15:16

Updated : 2026-10-23 23:10

NVD link : CVE-2026-67199

Mitre link : CVE-2026-67199

CVE.ORG link : CVE-2026-67199

JSON object : View

Products Affected

No product.

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-67199", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67199", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T16:45:42.646570Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/perspective-dev/perspective", "vendor": "perspective-dev", "product": "perspective", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.0.0"}], "packageURL": "pkg:github/perspective-dev/perspective", "defaultStatus": "affected"}]}], "published": "2026-08-04T15:16:40.570", "references": [{"url": "https://christbowel.com/blog/perspective-5-0-0-five-cves/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/perspective-dos-via-loop-expression-evaluation", "source": "disclosure@vulncheck.com"}, {"url": "https://christbowel.com/blog/perspective-5-0-0-five-cves/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large iteration count in an expression column evaluated once per table row, causing the Tornado IOLoop to block without any iteration cap, deadline, or cancellation check, rendering the server unresponsive to all connected clients."}, {"lang": "es", "value": "Perspective 5.0.0 contiene una vulnerabilidad de denegaci\u00f3n de servicio que permite a atacantes remotos bloquear el bucle de eventos del servidor indefinidamente al enviar una expresi\u00f3n manipulada que contiene construcciones de bucle for o while ilimitadas en un mensaje TableMakeViewReq. Los atacantes pueden incrustar un recuento de iteraciones arbitrariamente grande en una columna de expresi\u00f3n evaluada una vez por fila de tabla, haciendo que el Tornado IOLoop se bloquee sin ning\u00fan l\u00edmite de iteraci\u00f3n, fecha l\u00edmite o verificaci\u00f3n de cancelaci\u00f3n, dejando al servidor sin respuesta para todos los clientes conectados."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}