CVE-2026-67199
MediumCVSS 6.5Summary
Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large iteration count in an expression column evaluated once per table row, causing the Tornado IOLoop to block without any iteration cap, deadline, or cancellation check, rendering the server unresponsive to all connected clients.
Risk Assessment
An attacker can completely freeze the server, causing unavailability for all users.
Recommendation
Upgrade Perspective to a patched version and restrict server access to trusted clients only.
Other vulnerabilities in Perspective
See all- CVE-2026-67198High
Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher allowing unauthenticated attackers to crash the server process by sending malformed or incomplete protobuf messages.
- CVE-2026-67195High
Perspective 5.0.0 contains a remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary OS commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes input directly to Python's eval().
- CVE-2026-67200High
Perspective 5.0.0 contains a path traversal vulnerability allowing unauthenticated attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths.
- CVE-2026-67196Medium
Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization rendering. Attackers can craft table rows with payloads such as unquoted attribute injections containing event handler attributes that bypass RFC 4180 quoting, since angle brackets and event handler attributes are never escaped before assignment, causing malicious scripts to execute in the embedding page's origin.
Original NVD description (English source)
Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large iteration count in an expression column evaluated once per table row, causing the Tornado IOLoop to block without any iteration cap, deadline, or cancellation check, rendering the server unresponsive to all connected clients.