CVE-2026-74795 - Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion
Brief
CVE ID : CVE-2026-74795
Published : Aug. 16, 2026, 2:16 p. m.
- 50 minutes ago
Description : Scriban before 6.
- 0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does not enforce a default expression depth limit (the ExpressionDepthLimit property in ParserOptions defaults to null/disabled), so an attacker who controls template input can supply a deeply nested template (e. g.
, thousands of nested parentheses or blocks) that exhausts thread stack space and raises a StackOverflowException. Because a StackOverflowException cannot be caught in . NET, this causes immediate, unrecoverable termination of the hosting process, resulting in a denial of service. Applications that process untrusted or user-supplied templates can be exploited remotely without authentication.