{"id":"EUVD-2026-59948","enisaUuid":"4e7cf630-bec3-35b3-925f-101a64651d77","description":"Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, causing resource exhaustion and availability degradation.","datePublished":"Aug 16, 2026, 1:14:08 PM","dateUpdated":"Oct 8, 2026, 3:24:38 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/scriban/scriban/security/advisories/GHSA-q6rr-fm2g-g5x8\nhttps://www.vulncheck.com/advisories/scriban-through-denial-of-service-via-array-multiplication\n","aliases":"CVE-2026-73062\nGHSA-q84q-h76q-mqp7\n","assigner":"VulnCheck","epss":0.49,"enisaIdProduct":[{"id":"065f523a-66f5-31e8-a46c-da2e1584bb8b","product":{"name":"scriban","vendor":{"name":"scriban"}},"product_version":"3.0.0 ≤7.2.0"}],"enisaIdVendor":[{"id":"20f1090c-4736-3db1-88b7-75f04f501152","vendor":{"name":"scriban"}}],"enisaIdVulnerability":[{"id":"a4ba862b-ae77-31a8-b2f6-21a079608753","vulnerability":{"id":"GHSA-q84q-h76q-mqp7","description":"Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, causing resource exhaustion and availability degradation.","datePublished":"Aug 16, 2026, 3:30:25 PM","dateUpdated":"Aug 16, 2026, 3:30:25 PM","baseScore":0.0,"references":"https://github.com/scriban/scriban/security/advisories/GHSA-q6rr-fm2g-g5x8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73062\nhttps://www.vulncheck.com/advisories/scriban-through-denial-of-service-via-array-multiplication\n","enisa_id":"EUVD-2026-59948\n","aliases":"GHSA-q84q-h76q-mqp7\nCVE-2026-73062\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:51:44 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f5b63112-7941-3e3f-8735-5c6f0c171cdd","vulnerability":{"id":"CVE-2026-73062","description":"Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, causing resource exhaustion and availability degradation.","datePublished":"Aug 16, 2026, 1:14:08 PM","dateUpdated":"Oct 8, 2026, 3:24:38 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/scriban/scriban/security/advisories/GHSA-q6rr-fm2g-g5x8\nhttps://www.vulncheck.com/advisories/scriban-through-denial-of-service-via-array-multiplication\n","enisa_id":"EUVD-2026-59948\n","assigner":"VulnCheck","epss":0.49,"dataProcessed":"Nov 9, 2026, 3:06:10 PM","vulnerabilityProduct":[{"id":"7d4132c9-a3c2-372b-84ea-8ae9af657333","product":{"name":"scriban","vendor":{"name":"scriban"}},"product_version":"3.0.0 ≤7.2.0"}],"vulnerabilityVendor":[{"id":"6987e6bc-b892-3601-ad96-9297cfd8fe17","vendor":{"name":"scriban"}}]}}],"enisaIdAdvisory":[]}