Log in Start free

Vulnerability · Published Sep 22, 2026 · Assigned by GitHub_M

CVE-2026-57576plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in plone.app.contenttypes from plone. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.8%top 44.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0 through 4.0.9, and 5.0.0 are vulnerable to denial of service because an authenticated user can create content with excessively long titles, descriptions, or uploaded-file names, causing Plone to become unresponsive and potentially making the resulting content difficult to edit or delete. The vulnerability is patched in plone.app.dexterity versions 3.2.3, 4.1.3, and 5.0.1, and in plone.app.contenttypes versions 3.0.12, 4.0.10, and 5.0.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIplone-app-dexterity5.0.1GHSA-5426-92w4-wvhv
PyPIplone-app-dexterity4.1.3GHSA-5426-92w4-wvhv
PyPIplone-app-dexterity3.2.3GHSA-5426-92w4-wvhv
PyPIplone-app-dexterity3.2.3, 4.1.3, 5.0.1PYSEC-2026-4137

Affected products (as reported)

VendorProductVersions
plone plone.app.dexterity = 5.0.0>= 4.0.0, < 4.1.3< 3.2.3
plone plone.app.contenttypes = 5.0.0>= 4.0.0, < 4.0.10< 3.0.12

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References