CVE-2026-67199
Received Received - Intake

Perspective 5.0.0 DoS via Unbounded Loop in TableMakeViewReq

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulnCheck

Description
Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large iteration count in an expression column evaluated once per table row, causing the Tornado IOLoop to block without any iteration cap, deadline, or cancellation check, rendering the server unresponsive to all connected clients.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-67199
EUVD
EUVD-2026-52695

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
perspective perspective 5.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-67199 is a denial of service vulnerability in Perspective 5.0.0 where attackers send crafted expressions with unbounded loops in a TableMakeViewReq message. This blocks the server's event loop indefinitely by evaluating large iterations per table row, making the server unresponsive to all clients.

Detection Guidance

Monitor for unusually high CPU usage or unresponsive server processes. Check logs for repeated TableMakeViewReq messages with large iteration counts. Use network traffic analysis tools to detect abnormal expression evaluation patterns.

Impact Analysis

This vulnerability can cause your Perspective server to become completely unresponsive, preventing all connected clients from accessing the service. The server's event loop is blocked, halting normal operations until the issue is resolved.

Compliance Impact

This vulnerability primarily impacts availability by causing denial of service through server event loop blocking. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA compliance. However, prolonged unavailability could lead to violations of service level agreements or operational requirements in regulated environments.

Mitigation Strategies

Upgrade Perspective to a version that includes loop iteration limits or cancellation checks. Implement rate limiting on incoming TableMakeViewReq messages. Add monitoring to detect and terminate unbounded loop expressions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67199. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart