Threats Tagged 'ghsa-q6rr-fm2g-g5x8'

Scriban's array multiplication operator (array * integer) allows an attacker to cause excessive memory allocation without enforcement of iteration limits or overflow-safe arithmetic. This vulnerability enables denial-of-service by allocating multi-gigabyte arrays from small templates. It has existed since version 3.0.0 and remains present in version 7.2.0. The issue is due to missing LoopLimit checks and unchecked integer multiplication in the allocation size calculation. Attempts to allocate large arrays can cause out-of-memory exceptions wrapped as ScriptRuntimeException. This vulnerability is related to but distinct from previously fixed issues involving LoopLimit enforcement in Scriban.