CVE-2026-67198
Received Received - Intake

Denial-of-Service in Perspective 5.0.0 via Malformed Protobuf Messages

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulnCheck

Description
Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with no viewport set or MakeTableReq with no data field to trigger unwrap() calls on None values at nine distinct sites, causing the process to abort with SIGABRT.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-67198
EUVD
EUVD-2026-52694

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
perspective perspective 5.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-616 The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial-of-service vulnerability in Perspective 5.0.0's VirtualServer protocol dispatcher. It allows unauthenticated remote attackers to crash the server by sending malformed protobuf messages that omit required fields. The server crashes due to unwrap() calls on None values at nine code locations, causing process termination with SIGABRT.

Detection Guidance

Monitor for server crashes or SIGABRT signals in Perspective VirtualServer backends (DuckDB, ClickHouse, Polars) when receiving protobuf messages. Check logs for malformed requests like ViewToArrowReq without viewport or MakeTableReq without data fields.

Impact Analysis

This vulnerability can cause your Perspective server to crash repeatedly, making it unavailable for legitimate users. It requires no authentication and can be triggered remotely with small payloads. The impact is limited to service disruption since it doesn't allow data compromise or code execution.

Compliance Impact

This vulnerability primarily impacts availability by causing server crashes, which could disrupt services handling sensitive data. For GDPR, this may affect the right to access or rectify data if services become unavailable. For HIPAA, it could interrupt access to protected health information, potentially violating availability requirements. However, the vulnerability does not directly compromise confidentiality or integrity of data.

Mitigation Strategies

Upgrade Perspective to a patched version beyond 5.0.0. Implement input validation for protobuf messages to reject malformed requests. Apply Rust error-handling patterns consistently to prevent unwrap() calls on None values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67198. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart