CVE-2026-73060
Received Received - Intake

Scriban Template Engine Denial of Service via Lazy Sequence Multiplication

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: VulnCheck

Description
Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU cores and exhausting garbage collection resources even when LoopLimit is set to 1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-73060
EUVD
EUVD-2026-59946

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
scriban scriban From 3.0.0 (inc) to 7.2.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial of service flaw in Scriban template engine versions 3.0.0 through 7.2.5. It involves the ScriptRange.Multiply operator bypassing the LoopLimit safeguard when the left operand is a lazy sequence. Attackers can craft templates with array multiplication on lazy sequences to execute excessive iterations, consuming CPU and garbage collection resources even when LoopLimit is set to 1.

Detection Guidance

Check Scriban version with 'dotnet list package | grep Scriban' or inspect project files for Scriban versions between 3.0.0 and 7.2.5. Monitor CPU and memory usage spikes during template rendering operations, especially with lazy sequences or array multiplication.

Impact Analysis

This vulnerability can impact you by allowing attackers to perform denial of service attacks on applications using vulnerable Scriban versions. It can pin CPU cores, exhaust garbage collection resources, and cause system slowdowns or crashes by executing billions of unchecked iterations with minimal input.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by exhausting CPU and memory resources through excessive iterations. It does not directly impact data confidentiality or integrity but may lead to system unavailability, which could violate availability requirements in GDPR (Article 32) and HIPAA (Security Rule §164.308(a)(7)).

Mitigation Strategies

Update Scriban to the latest fixed version (7.2.5+). If updating is not possible, disable template rendering from untrusted sources or implement strict input validation for templates containing array multiplication operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73060. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart