Vulnerability · Published Aug 4, 2026 · Assigned by VulnCheck

CVE-2026-67199Perspective 5.0.0 DoS via Loop Expression Evaluation

Medium 6.5

In plain English

A medium-severity resource allocation without limits in perspective from perspective-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 55.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large iteration count in an expression column evaluated once per table row, causing the Tornado IOLoop to block without any iteration cap, deadline, or cancellation check, rendering the server unresponsive to all connected clients.

Affected products (as reported)

Vendor	Product	Versions
perspective-dev	perspective	0 – through 5.0.0

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/perspective-dos-via-loop-expression-evaluation third-party-advisory