CVE-2026-67198

HighCVSS 7.5/10Last modified Oct 23, 2026

Description

Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with no viewport set or MakeTableReq with no data field to trigger unwrap() calls on None values at nine distinct sites, causing the process to abort with SIGABRT.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-616

Affected software

No affected versions have been published.

Timeline

Published: Aug 4, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-671996.5Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by sub CVE-2026-67207.2When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configura CVE-2026-672007.5Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the serv CVE-2026-672018.6V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circum CVE-2026-672045.4BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delet CVE-2026-672068.8Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to crea CVE-2026-672078.8Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrat CVE-2026-672089.8Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS com CVE-2026-67219.8IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS co CVE-2026-672117.5OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 (T CVE-2026-672137.5nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configure CVE-2026-672147.5nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nan