EUVD-2026-52694
GHSA-pr84-483f-rmg2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, no auth required, no user interaction; impact is total availability loss of server process with no confidentiality or integrity consequence and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with no viewport set or MakeTableReq with no data field to trigger unwrap() calls on None values at nine distinct sites, causing the process to abort with SIGABRT.
AnalysisAI
Unauthenticated remote denial-of-service in Perspective 5.0.0 crashes the server process by exploiting missing field validation in the VirtualServer protocol dispatcher. Attackers send syntactically valid but semantically incomplete protobuf messages - such as ViewToArrowReq without a viewport or MakeTableReq without a data field - triggering Rust unwrap() calls on None values at nine distinct code sites, each causing an immediate SIGABRT process abort. No public exploit is confirmed actively exploited (no CISA KEV listing), but a publicly available proof-of-concept exists via a researcher blog post, and the attack requires no authentication against a network-accessible endpoint.
Technical ContextAI
Perspective is an open-source high-performance streaming data visualization and analytics library maintained under the perspective-dev organization (CPE: cpe:2.3:a:perspective-dev:perspective:*:*:*:*:*:*:*:*). The VirtualServer component exposes a request dispatcher that accepts Google Protocol Buffer (protobuf) encoded messages from remote clients to perform operations such as viewport management and table construction. The server-side dispatcher is implemented in Rust and relies on Option::unwrap() to extract expected fields from incoming messages. When a client omits required fields, the dispatcher calls unwrap() on a None value rather than handling the absent field gracefully, immediately triggering a Rust panic that the runtime escalates to SIGABRT, killing the server process. The listed CWE is CWE-616, though this maps more precisely to CWE-252 (Unchecked Return Value) or CWE-476 (NULL Pointer Dereference analog in Rust), as the root cause is the absence of defensive Option handling before unwrapping. Nine distinct crash-triggering call sites were identified, indicating a systemic pattern of missing input validation rather than an isolated bug.
RemediationAI
No specific patched release version is identified in the available data; upstream fix availability should be confirmed by monitoring the perspective-dev GitHub repository and the VulnCheck advisory at https://www.vulncheck.com/advisories/perspective-dos-via-virtualserver-protocol-dispatcher. Until a patched version is confirmed released, deployments should restrict network access to the VirtualServer dispatcher endpoint using firewall rules or network-level ACLs to permit only trusted client IP ranges - this eliminates the unauthenticated remote attack surface with no functional impact to authorized users. As a secondary control, deploying a reverse proxy or API gateway that validates protobuf message field completeness before forwarding to the VirtualServer can prevent malformed messages from reaching the vulnerable dispatcher; note this requires protobuf-aware inspection capability. If the VirtualServer component is not actively used, disabling it entirely removes the attack surface without affecting other Perspective functionality. Organizations should track the nine distinct crash sites documented in the researcher's disclosure to verify that a future patch addresses all of them.
More in Perspective
View allPerspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and c
Remote unauthenticated file disclosure in perspective-dev/perspective 5.0.0 allows any network attacker to read arbitrar
Remote code execution in Perspective 5.0.0 exposes any network-reachable PolarsVirtualServer backend to arbitrary OS com
Denial of service in Perspective 5.0.0 allows low-privileged remote attackers to render the server permanently unrespons
Cross-site scripting in Perspective 5.0.0's built-in Debug plugin enables an authenticated attacker with low privileges
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today