CVE-2026-67198 Perspective 5.0.0 DoS via VirtualServer Protocol Dispatcher
Unauthenticated attackers can crash the Perspective server by sending malformed protobuf messages, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-67198?
CVE-2026-67198 is a high-severity denial of service vulnerability in perspective-dev perspective, published on 4 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with no viewport set or MakeTableReq with no data field to trigger unwrap() calls on None values at nine distinct sites, causing the process to abort with SIGABRT.
Weakness: CWE-616
Which versions are affected by CVE-2026-67198?
How do I fix CVE-2026-67198?
No fix has been published for CVE-2026-67198 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-67198 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67198 exists.
Sources
Also known as GHSA-pr84-483f-rmg2.