CVE-2026-123660 (GCVE-0-2026-123660)

Vulnerability from cvelistv5 – Published: 2026-11-06 08:58 – Updated: 2026-11-10 17:40
VLAI
Title
Vulnerability-Lookup: memory amplification through webhook payload template format specifiers
Summary
In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input through a webhook notification's payload template. Each placeholder's format specifier was passed unchanged to Python's string formatting, which builds the padded result before its size can be checked. A template of a few dozen bytes, such as {"text": "{title:>999999999}"}, therefore produced a string of about 1 GB when the notification form test-rendered it on save, and repeating such fields multiplied the cost. Templates that passed the save check could also repeat placeholders such as {text} thousands of times; the notification daemon rebuilt those on every webhook delivery. Deeply nested templates raised an unhandled recursion error (HTTP 500). An attacker needs only an account, which the default configuration lets anyone create after e-mail confirmation. They could exhaust the memory of web workers or the notification daemon, causing a denial of service. Version 6.4.1 caps every number in a format specifier at 256, limits a rendered template to 1,000,000 characters both on save and at delivery, and rejects templates nested deeper than 32 levels.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 17:39 UTC
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
  • CWE-1284 - Improper Validation of Specified Quantity in Input
  • CWE-674 - Uncontrolled Recursion
Assigner
CIRCL CNA under the ENISA root
CNA scorecard A 90/100 over 251 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
vulnerability-lookup vulnerability-lookup Affected: 5.5.1 , < 6.4.1 (semver)
guessed Create a notification for this product.
Credits
Matteo Panzeri (Università di Pavia), GitHub @matte1782 Claude Opus 5 Cédric Bonhomme
GCVE extensions
bcp-05-x-03
Vulnerability handling and disclosure timeline
GCVE-BCP-05-X-03
Report to fix
same day (reported 2026-11-05 19:41 UTC → fix available 2026-11-06 08:24 UTC)
Report to disclosure
same day (reported 2026-11-05 19:41 UTC → public disclosure 2026-11-06 08:24 UTC)
  1. 2026-11-05 19:41 UTC Reported researcher Private report sent to info@circl.lu, based on a bounded local run against commit 2bb9b2f0; no request was sent to the public service.
  2. 2026-11-06 Validated vendor Reproduced on the save and delivery paths; review found related amplification via repeated placeholders and an unhandled recursion error.
  3. 2026-11-06 fix-deployed vendor 6.4.1 deployed on the CIRCL production instance.
  4. 2026-11-06 08:10 UTC Fix developed vendor
  5. 2026-11-06 08:24 UTC Fix available vendor Vulnerability-Lookup 6.4.1 released.
  6. 2026-11-06 08:24 UTC Public disclosure vendor Fix and changelog entry describing the issue made public with the 6.4.1 release.
  7. 2026-11-06 08:43 UTC Identifier assigned gna GCVE-1-2026-20054 assigned.
  8. 2026-11-06 08:43 UTC Advisory published gna
EU Cyber Resilience Act EU-CRA EU Not applicable

No exploitation observed; the Article 14 notification obligations for actively exploited vulnerabilities do not apply.

Deadlines and status are stated by the publisher. Submitting on time is not evidence of compliance, and this page does not judge it.

Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-123660",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T17:39:52.273550Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T17:40:09.862Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "vulnerability-lookup",
          "vendor": "vulnerability-lookup",
          "versions": [
            {
              "lessThan": "6.4.1",
              "status": "affected",
              "version": "5.5.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Matteo Panzeri (Universit\u00e0 di Pavia), GitHub @matte1782"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "C\u00e9dric Bonhomme"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input through a webhook notification\u0027s payload template. Each placeholder\u0027s format specifier was passed unchanged to Python\u0027s string formatting, which builds the padded result before its size can be checked. A template of a few dozen bytes, such as {\"text\": \"{title:\u0026gt;999999999}\"}, therefore produced a string of about 1 GB when the notification form test-rendered it on save, and repeating such fields multiplied the cost. Templates that passed the save check could also repeat placeholders such as {text} thousands of times; the notification daemon rebuilt those on every webhook delivery. Deeply nested templates raised an unhandled recursion error (HTTP 500). An attacker needs only an account, which the default configuration lets anyone create after e-mail confirmation. They could exhaust the memory of web workers or the notification daemon, causing a denial of service. Version 6.4.1 caps every number in a format specifier at 256, limits a rendered template to 1,000,000 characters both on save and at delivery, and rejects templates nested deeper than 32 levels."
            }
          ],
          "value": "In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input through a webhook notification\u0027s payload template. Each placeholder\u0027s format specifier was passed unchanged to Python\u0027s string formatting, which builds the padded result before its size can be checked. A template of a few dozen bytes, such as {\"text\": \"{title:\u003e999999999}\"}, therefore produced a string of about 1 GB when the notification form test-rendered it on save, and repeating such fields multiplied the cost. Templates that passed the save check could also repeat placeholders such as {text} thousands of times; the notification daemon rebuilt those on every webhook delivery. Deeply nested templates raised an unhandled recursion error (HTTP 500). An attacker needs only an account, which the default configuration lets anyone create after e-mail confirmation. They could exhaust the memory of web workers or the notification daemon, causing a denial of service. Version 6.4.1 caps every number in a format specifier at 256, limits a rendered template to 1,000,000 characters both on save and at delivery, and rejects templates nested deeper than 32 levels."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T09:04:51.732Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/2076ffdae3d024649114eeb6fd185338d4bb1f40"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Vulnerability-Lookup: memory amplification through webhook payload template format specifiers",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-03": {
              "x_timeline": {
                "entities": [
                  {
                    "category": "discoverer",
                    "id": "entity-reporter",
                    "name": "Matteo Panzeri",
                    "references": [
                      "https://github.com/matte1782"
                    ]
                  },
                  {
                    "category": "vendor",
                    "description": "Maintainer of Vulnerability-Lookup and operator of the vulnerability.circl.lu instance.",
                    "id": "entity-circl",
                    "name": "CIRCL",
                    "references": [
                      "https://github.com/vulnerability-lookup/vulnerability-lookup"
                    ]
                  }
                ],
                "events": [
                  {
                    "actor": "researcher",
                    "actorRefs": [
                      "entity-reporter"
                    ],
                    "description": "Private report sent to info@circl.lu, based on a bounded local run against commit 2bb9b2f0; no request was sent to the public service.",
                    "id": "evt-reported",
                    "recipientRefs": [
                      "entity-circl"
                    ],
                    "timestamp": "2026-11-05T19:41:52Z",
                    "type": "reported"
                  },
                  {
                    "actor": "vendor",
                    "actorRefs": [
                      "entity-circl"
                    ],
                    "description": "Reproduced on the save and delivery paths; review found related amplification via repeated placeholders and an unhandled recursion error.",
                    "id": "evt-validated",
                    "referencedEvents": [
                      "evt-reported"
                    ],
                    "timestamp": "2026-11-06",
                    "type": "validated"
                  },
                  {
                    "actor": "vendor",
                    "actorRefs": [
                      "entity-circl"
                    ],
                    "id": "evt-fix-developed",
                    "referencedEvents": [
                      "evt-validated"
                    ],
                    "references": [
                      "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/2076ffdae3d024649114eeb6fd185338d4bb1f40"
                    ],
                    "timestamp": "2026-11-06T08:10:26Z",
                    "type": "fix-developed"
                  },
                  {
                    "actor": "vendor",
                    "actorRefs": [
                      "entity-circl"
                    ],
                    "description": "Vulnerability-Lookup 6.4.1 released.",
                    "id": "evt-fix-available",
                    "referencedEvents": [
                      "evt-fix-developed"
                    ],
                    "references": [
                      "https://github.com/vulnerability-lookup/vulnerability-lookup/releases/tag/v6.4.1"
                    ],
                    "timestamp": "2026-11-06T08:24:38Z",
                    "type": "fix-available"
                  },
                  {
                    "actor": "vendor",
                    "actorRefs": [
                      "entity-circl"
                    ],
                    "description": "Fix and changelog entry describing the issue made public with the 6.4.1 release.",
                    "id": "evt-public-disclosure",
                    "references": [
                      "https://github.com/vulnerability-lookup/vulnerability-lookup/blob/v6.4.1/CHANGELOG.md"
                    ],
                    "timestamp": "2026-11-06T08:24:38Z",
                    "type": "public-disclosure"
                  },
                  {
                    "actor": "vendor",
                    "actorRefs": [
                      "entity-circl"
                    ],
                    "description": "6.4.1 deployed on the CIRCL production instance.",
                    "id": "evt-fix-deployed",
                    "referencedEvents": [
                      "evt-fix-available"
                    ],
                    "timestamp": "2026-11-06",
                    "type": "fix-deployed"
                  },
                  {
                    "actor": "gna",
                    "actorRefs": [
                      "entity-circl"
                    ],
                    "description": "GCVE-1-2026-20054 assigned.",
                    "id": "evt-identifier-assigned",
                    "timestamp": "2026-11-06T08:43:51Z",
                    "type": "identifier-assigned"
                  },
                  {
                    "actor": "gna",
                    "actorRefs": [
                      "entity-circl"
                    ],
                    "id": "evt-advisory-published",
                    "referencedEvents": [
                      "evt-identifier-assigned"
                    ],
                    "references": [
                      "https://vulnerability.circl.lu/vuln/gcve-1-2026-20054"
                    ],
                    "timestamp": "2026-11-06T08:43:51Z",
                    "type": "advisory-published"
                  }
                ],
                "regulatory": [
                  {
                    "assessment": "not-applicable",
                    "framework": "EU-CRA",
                    "jurisdiction": "EU",
                    "notes": "No exploitation observed; the Article 14 notification obligations for actively exploited vulnerabilities do not apply."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-20054"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-123660",
    "datePublished": "2026-11-06T08:58:24.857Z",
    "dateReserved": "2026-11-06T08:57:03.368Z",
    "dateUpdated": "2026-11-10T17:40:09.862Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-123660",
      "date": "2026-11-10",
      "epss": "0.00294",
      "percentile": "0.22163"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "vulnerability-lookup",
                "vendor": "vulnerability-lookup",
                "versions": [
                  {
                    "lessThan": "6.4.1",
                    "status": "affected",
                    "version": "5.5.1",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input through a webhook notification\u0027s payload template. Each placeholder\u0027s format specifier was passed unchanged to Python\u0027s string formatting, which builds the padded result before its size can be checked. A template of a few dozen bytes, such as {\"text\": \"{title:\u003e999999999}\"}, therefore produced a string of about 1 GB when the notification form test-rendered it on save, and repeating such fields multiplied the cost. Templates that passed the save check could also repeat placeholders such as {text} thousands of times; the notification daemon rebuilt those on every webhook delivery. Deeply nested templates raised an unhandled recursion error (HTTP 500). An attacker needs only an account, which the default configuration lets anyone create after e-mail confirmation. They could exhaust the memory of web workers or the notification daemon, causing a denial of service. Version 6.4.1 caps every number in a format specifier at 256, limits a rendered template to 1,000,000 characters both on save and at delivery, and rejects templates nested deeper than 32 levels."
          }
        ],
        "id": "CVE-2026-123660",
        "lastModified": "2026-11-10T18:17:28.053",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-123660",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T17:39:52.273550Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-11-06T09:17:01.367",
        "references": [
          {
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/2076ffdae3d024649114eeb6fd185338d4bb1f40"
          }
        ],
        "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-674"
              },
              {
                "lang": "en",
                "value": "CWE-770"
              },
              {
                "lang": "en",
                "value": "CWE-1284"
              }
            ],
            "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.