CVE-2026-67199

6.5 MEDIUM

Published 2026-08-04 · Updated 2026-08-04

AI risk analysis

Summary: The flaw allows remote attackers to create a denial of service by submitting a crafted expression with an unbounded loop in a TableMakeViewReq message, blocking the server event loop indefinitely.
Exploitability: Exploitation requires sending a specific crafted request; preconditions include the target running Perspective 5.0.0.
Blast radius: If exploited, it could render the server unresponsive to all connected clients, impacting service availability and user experience.
Prioritized remediation: Update to a patched version of Perspective or apply vendor-provided patches immediately.

dosserverlooptornado

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large iteration count in an expression column evaluated once per table row, causing the Tornado IOLoop to block without any iteration cap, deadline, or cancellation check, rendering the server unresponsive to all connected clients.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-770

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.