Which versions of Perspective are affected by CVE-2026-67199?

A denial-of-service vulnerability in Perspective 5.0.0 enables remote attackers to render affected servers permanently unresponsive through a single malicious request, causing complete service…

Is there a public PoC exploit available for CVE-2026-67199?

Yes, a public proof-of-concept exploit is available for CVE-2026-67199. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-67199?

Within 24 hours, identify all systems running Perspective 5.0.0 and assess network accessibility; implement network-based filtering on upstream load balancers to reject or rate-limit TableMakeViewReq messages with expression columns containing loop constructs, and establish alerting for server process stalls and IOLoop hangs. Within 7 days, contact Perspective vendor support to request interim configuration options (such as expression evaluation timeouts or request deadline enforcement) and implement request input validation to reject expressions containing unbounded for/while loops at the application layer. Within 30 days, monitor vendor security advisories for patched Perspective versions, develop and test an upgrade plan to the earliest available patched release, and implement architectural mitigations such as request queue limits with timeouts to prevent single requests from blocking the event loop.

Perspective CVE-2026-67199

Q: What is the CVSS score of CVE-2026-67199?

CVE-2026-67199 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-52695 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-04 VulnCheck

GHSA-vc2q-3q58-3rrv

Denial Of Service Perspective

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable, low complexity, PR:L per CVSS 4.0 alignment; no scope change, confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 15:23 vuln.today

CVE Published

Aug 04, 2026 - 14:04 cve.org

HIGH 7.1

DescriptionCVE.org

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large iteration count in an expression column evaluated once per table row, causing the Tornado IOLoop to block without any iteration cap, deadline, or cancellation check, rendering the server unresponsive to all connected clients.

AnalysisAI

Denial of service in Perspective 5.0.0 allows low-privileged remote attackers to render the server permanently unresponsive by submitting a crafted TableMakeViewReq message containing expression columns with unbounded for or while loop constructs. Because the Tornado IOLoop evaluates the expression once per table row with no iteration cap, deadline enforcement, or cancellation mechanism, a single malicious request stalls the entire event loop and blocks all connected clients. A publicly available proof-of-concept exploit exists, and the vulnerability is part of a batch of five CVEs disclosed against this version.

Technical ContextAI

Perspective (CPE: cpe:2.3:a:perspective-dev:perspective:*:*:*:*:*:*:*:*) is an open-source, WebAssembly-powered streaming data visualization and analytics library originally developed at J.P. Morgan and now maintained under FINOS. It exposes a server-side component built on Python's Tornado framework, using an IOLoop (single-threaded cooperative event loop) to handle client connections. The TableMakeViewReq message type allows clients to define computed expression columns that are evaluated row-by-row against the underlying table data. CWE-770 (Allocation of Resources Without Limits or Throttling) describes the root cause: the expression evaluator imposes no upper bound on loop iterations, no wall-clock deadline, and no cooperative yielding or cancellation hook, meaning an adversarially crafted loop expression can consume the IOLoop thread indefinitely. Because Tornado's IOLoop is inherently single-threaded and non-preemptive, one blocked coroutine stalls the entire server.

RemediationAI

No vendor-released patch version has been independently confirmed in the available data at time of analysis; users should monitor the VulnCheck advisory at https://www.vulncheck.com/advisories/perspective-dos-via-loop-expression-evaluation and the official perspective-dev repository for a patched release. As an immediate compensating control, restrict access to the Perspective server to trusted, authenticated users only - since PR:L is required, eliminating public or anonymous access removes the unauthenticated attack surface. If the expression evaluation feature is not required for the deployment, disabling computed expression columns via server-side configuration eliminates the vulnerable code path entirely, though this may impact analytical functionality. Network-level controls such as placing the Perspective server behind an authenticated reverse proxy or API gateway with per-client request rate limiting can reduce the frequency of abuse but cannot prevent a single crafted request from blocking the IOLoop once received. Sandboxing expression evaluation in a separate worker process or thread with a hard timeout would address the root cause architecturally but requires code changes.