What is CVE-2026-73062?
A Denial of Service vulnerability exists in Scriban (versions 3.0.0 through 7.2.0) within the array multiplication operator, which allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. An attacker can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, and it is recommended to update immediately to prevent resource exhaustion.
Azərbaycanca: Scriban şablon mühərrikində (3.0.0-7.2.0) array vurma operatorunda tapılan boşluq səbəbindən, təcavüzkar böyük integer dəyər ötürməklə memory allocation yoxlamalarından yan keçib Denial of Service yarada bilər. LoopLimit olmadığı üçün multi-gigabaytlıq yaddaş ayrılması tetiklene bilər, istifadəçilərə resurs tükənməsinə qarşı dərhal yeniləmə etmələri tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-400
FAQ2
Which versions of Scriban are affected by CVE-2026-73062?
This Denial of Service vulnerability affects Scriban versions 3.0.0 through 7.2.0.
How can an attacker trigger resource exhaustion using CVE-2026-73062?
An attacker can supply a large integer multiplier in a template to force multi-gigabyte memory allocations because the array multiplication operator does not enforce LoopLimit.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.