Resource exhaustion in Perspective-Dev Perspective
CVE-2026-67199
Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large iteration count in an expression column evaluated once per table row, causing the Tornado IOLoop to block without any iteration cap, deadline, or cancellation check, rendering the server unresponsive to all connected clients.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.005 (44.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 44th percentile — 44.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Perspective-Dev Perspective — versions 0
Weakness classification (CWE)
References
- christbowel.com/blog/perspective-5-0-0-five-cves/ (technical-description, exploit)
- www.vulncheck.com/advisories/perspective-dos-via-loop-expression-evaluation (third-party-advisory)
Frequently asked questions
- What is CVE-2026-67199?
- CVE-2026-67199 is a medium-severity vulnerability in Perspective-Dev Perspective, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 6.5/10. Published 2026-08-04.
- How severe is CVE-2026-67199?
- Medium severity. CVSS v3 base score is 6.5 out of 10.