Resource exhaustion in Perspective-Dev Perspective
CVE-2026-67199
Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large iteration count in an expression column evaluated once per table row, causing the Tornado IOLoop to block without any iteration cap, deadline, or cancellation check, rendering the server unresponsive to all connected clients.
EPSS: 0.004 (28.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Perspective-dev Perspective — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (technical-description, exploit)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-67199?
- CVE-2026-67199 is a medium-severity vulnerability in Perspective-Dev Perspective, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 6.5/10. Published 2026-08-04.
- How severe is CVE-2026-67199?
- Medium severity. CVSS v3 base score is 6.5 out of 10.