Scriban Resource Exhaustion via Template Processing

Executive Summary

CVE-2026-124437 is a resource exhaustion vulnerability in Scriban versions 7.5.2 and earlier. It allows untrusted template authors to crash systems or degrade performance by exploiting built-in functions like math.format, regex.replace, and string.escape. These functions bypass memory allocation limits, enabling excessive CPU and memory usage. Attackers can craft small templates with large precision specifiers or recursive operations that ignore safeguards like LoopLimit and CancellationToken.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for excessive memory or CPU usage by Scriban processes. Check for templates using functions like math.format, regex.replace, or string.escape with unusually high precision or recursion. Look for stalled or unresponsive Scriban instances in multi-tenant environments.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can crash applications or servers by exhausting memory and CPU resources. In multi-tenant environments, it may degrade performance or cause outages. Systems could experience OOM (Out of Memory) kills or become unresponsive due to pinned CPU usage. Even small malicious templates can trigger severe resource consumption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to denial-of-service conditions by exhausting memory and CPU resources, which may cause system crashes or prolonged downtime. Such disruptions could violate compliance requirements under GDPR (e.g., availability of personal data processing) and HIPAA (e.g., ensuring access to protected health information).

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Scriban to version 7.5.3 or later to address the missing allocation guards and loop limits. Implement strict input validation for templates to prevent malicious precision specifiers or unbounded operations. Monitor and restrict resource usage in multi-tenant environments.

Useful 0 Not Useful 0