CVE-2026-67199 Details
Description
Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large iteration count in an expression column evaluated once per table row, causing the Tornado IOLoop to block without any iteration cap, deadline, or cancellation check, rendering the server unresponsive to all connected clients.
A denial-of-service vulnerability has been identified in Perspective version 5.0.0. This issue allows remote attackers to block the server's event loop indefinitely by sending a crafted expression that includes unbounded 'for' or 'while' loop constructs. The vulnerability is exploited through a 'TableMakeViewReq' message, where attackers can embed a large iteration count in an expression column. This column is evaluated for each row in the table, causing the Tornado IOLoop to become unresponsive without any limits or cancellation options. As a result, the server fails to respond to all connected clients.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 4, 2026CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://christbowel.com/blog/perspective-5-0-0-five-cves/ | CISA-ADP | BundleExploitRemedyTechnical Analysis |
| https://christbowel.com/blog/perspective-5-0-0-five-cves/ | [email protected] | BundleExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/perspective-dos-via-loop-expression-evaluation | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Perspective | <= 5.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |