CVE-2026-74794 Scriban before 6.6.0 Denial of Service via Infinite Recursion
Attackers can cause a denial of service in applications using Scriban by supplying circular references that trigger infinite recursion and stack overflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-74794?
CVE-2026-74794 is a high-severity denial of service vulnerability in scriban, published on 16 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process.
Weakness: CWE-674
Which versions are affected by CVE-2026-74794?
4 open source packages ship an affected version, including Scriban.Signed and scriban.
| Package | Affected | Fixed in |
|---|---|---|
Scriban.Signed NuGet | All versions | 6.6.0 |
Scriban.Signed NuGet | All versions | 6.6.0 |
scriban NuGet | All versions | 6.6.0 |
scriban NuGet | All versions | 6.6.0 |
How do I fix CVE-2026-74794?
Upgrade Scriban.Signed to 6.6.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74794 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-74794 exists.
Sources
Also known as GHSA-grr9-747v-xvcp, GHSA-pprh-wgqr-2mmx.