CVE-2026-73062 Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication
Attackers can cause resource exhaustion and denial of service by supplying large integer multipliers in templates, affecting applications using the Scriban library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73062?
CVE-2026-73062 is a high-severity denial of service vulnerability in scriban, published on 16 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, causing resource exhaustion and availability degradation.
Weakness: CWE-770
Which versions are affected by CVE-2026-73062?
4 open source packages ship an affected version, including Scriban and Scriban.Signed.
| Package | Affected | Fixed in |
|---|---|---|
Scriban NuGet | From 3.0.0 | 7.2.1 |
Scriban NuGet | From 3.0.0 | 7.2.1 |
Scriban.Signed NuGet | From 3.0.0 | 7.2.1 |
Scriban.Signed NuGet | From 3.0.0 | 7.2.1 |
How do I fix CVE-2026-73062?
Upgrade Scriban to 7.2.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-73062 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73062 exists.
Sources
Also known as GHSA-q6rr-fm2g-g5x8, GHSA-q84q-h76q-mqp7.