Description

Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, causing resource exhaustion and availability degradation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-16T14:16:55.903Z",
  "pubdate": "2026-08-16T14:16:55.903Z",
  "executiveSummary": "Scriban versions 3.0.0 through 7.2.0 are affected by a denial of service vulnerability residing within the array multiplication operator. This security flaw stems from insufficient enforcement of configured limits and a lack of overflow-safe arithmetic checks during memory allocation operations. Consequently, unauthenticated remote attackers capable of supplying template inputs can trigger massive, multi-gigabyte memory allocations via malicious multiplication factors. The resulting resource exhaustion rapidly degrades system availability, leading to potential application crashes and service outages. The risk implications are severe for environments processing untrusted templates, as exploitation requires only the ability to supply a crafted payload containing a large integer multiplier to the template engine. Remediation requires updating the affected product to a secure version where input bounds and safe arithmetic are properly enforced.",
  "technicalDetails": "The vulnerability is localized within the array multiplication operator of the Scriban template engine, specifically impacting versions 3.0.0 through 7.2.0. The root cause of the flaw is the failure of the memory allocation routines associated with array multiplication to enforce the established LoopLimit constraints and to perform overflow-safe arithmetic checks when calculating required buffer sizes. During template execution, when the array multiplication operator evaluates an operation involving an integer multiplier provided within the template input, it improperly validates the resulting size of the requested memory allocation. An attacker exploits this behavior by constructing a malicious payload containing an excessively large integer multiplier. When the Scriban engine processes this crafted template expression, the unchecked multiplication results in an immense calculated size value without triggering overflow exceptions or constraint validations. The payload behavior forces the underlying runtime to allocate multi-gigabyte memory blocks instantaneously to satisfy the inflated dimension request. The step-by-step attack flow begins with the adversary submitting an untrusted template containing the oversized multiplier through an exposed template rendering interface. Upon parsing and evaluating the template, the vulnerable component processes the array multiplication operator without proper bounds validation. The lack of loop and limit enforcement allows the operation to bypass safety thresholds, directly triggering the massive memory allocation. The immediate post-exploitation impact is severe resource exhaustion, consuming available system memory and causing memory management subsystems to trigger Out-Of-Memory exceptions, thereby halting the application process and causing complete availability degradation. No specific authentication, elevated privileges, or complex network exposure prerequisites are required beyond the ability to supply input data to the template rendering engine."
}