CVE-2026-74788
Received Received - Intake

Uncontrolled Memory Allocation in Scriban Template Engine

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: VulnCheck

Description
Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability in the string.pad_left and string.pad_right template functions, which perform no validation on the width parameter before delegating to .NET's String.PadLeft/PadRight. When an application exposes Scriban to untrusted template input, an attacker can supply an arbitrarily large width value (e.g., 500,000,000) to trigger ~1GB memory allocations in a single call, resulting in OutOfMemoryException and denial of service. The TemplateContext.LimitToString limit does not prevent this because it is only enforced after the string has been fully allocated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-74788
EUVD
EUVD-2026-59954

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
scriban scriban to 7.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-74788 is a Denial of Service (DoS) vulnerability in Scriban versions before 7.0.0. It affects the string.pad_left and string.pad_right template functions which do not validate the width parameter before allocating memory. Attackers can exploit this by providing an extremely large width value (e.g., 500,000,000), causing the system to allocate around 1GB of memory in a single call. This leads to an OutOfMemoryException and crashes the application.

Detection Guidance

Monitor for unusually high memory usage or OutOfMemoryException errors in applications using Scriban versions <= 6.6.0. Check logs for large width values in string.pad_left or string.pad_right function calls. Use tools like perfmon or system monitoring to detect sudden memory spikes.

Impact Analysis

If you use Scriban in an application that processes untrusted template input, an attacker could send a specially crafted request to trigger excessive memory allocation. This can crash your application or service, causing downtime. For example, a single HTTP request with a malicious template could consume ~1GB of memory, and sustained attacks could maintain high memory pressure (~30GB per minute), preventing recovery.

Compliance Impact

This vulnerability primarily causes denial of service through memory exhaustion, which could disrupt services handling sensitive data. For GDPR, availability is a key principle, and prolonged outages may violate Article 32 requirements for security of processing. HIPAA's Security Rule also emphasizes availability of ePHI, so service disruptions could pose compliance risks if not addressed promptly.

Mitigation Strategies

Upgrade Scriban to version 7.0.0 or later. If upgrading is not possible, implement input validation to cap the width parameter for string.pad_left and string.pad_right functions at a safe limit (e.g., 1MB). Disable untrusted template input exposure if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74788. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart