Skip to main content

CVE-2026-57576: CWE-400: Uncontrolled Resource Consumption in plone plone.app.dexterity

0
Medium
VulnerabilityCVE-2026-57576cvecve-2026-57576cwe-400
Published: 09/22/2026 (09/22/2026, 23:01:22 UTC)
Source: CVE Database V5
Vendor/Project: plone
Product: plone.app.dexterity

Description

plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0 through 4.0.9, and 5.0.0 are vulnerable to denial of service because an authenticated user can create content with excessively long titles, descriptions, or uploaded-file names, causing Plone to become unresponsive and potentially making the resulting content difficult to edit or delete. The vulnerability is patched in plone.app.dexterity versions 3.2.3, 4.1.3, and 5.0.1, and in plone.app.contenttypes versions 3.0.12, 4.0.10, and 5.0.1.

CVSS v3.1

Score 6.5medium

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

plone

plone.app.dexterity

Affected versions
>=4.0.0 <4.1.3<3.2.3=5.0.0

plone

plone.app.contenttypes

Affected versions
>=4.0.0 <4.0.10<3.0.12=5.0.0

Technical Details

Data Version
5.2
Assigner Short Name
GitHub_M
Date Reserved
2026-06-24T18:49:56.208Z
Cvss Version
3.1
State
PUBLISHED

Threat ID: 6ab30cbbf7a7c54106e95de4

Added to database: 09/22/2026, 23:18:19 UTC

Last updated: 09/22/2026, 23:18:19 UTC

Views: 1

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses