CVE-2026-55254 Details

A denial-of-service vulnerability has been identified in NCalc, a lightweight expression evaluator for .NET, in versions prior to 6.1.1. The issue arises in the factorial operator implementation, where specially crafted expressions with large factorial operands can cause excessive CPU usage or lead to a non-terminating loop. This behavior is due to integer overflow in the factorial calculation logic, allowing applications to become unresponsive when evaluating untrusted expressions.

Users are advised to upgrade to NCalc version 6.1.1 or later, which includes the necessary fix. If an immediate upgrade is not possible, expressions from untrusted sources should be avoided, and factorial operations on large values should be validated or sanitized before evaluation. Additionally, execution time limits or request timeouts can be implemented to reduce exposure.