Perspective CVE-2026-67199

Exploitation requires low-privilege access to submit a TableMakeViewReq message to the Perspective server - an authenticated or otherwise credentialed session is needed, consistent with the CVSS 4.0 PR:L metric. The attacker must be able to create or modify a view with a computed expression column containing an unbounded loop construct (for or while). No special server configuration beyond a running Perspective 5.0.0 instance is required; this is the default behavior of the expression evaluator. What limits exploitation: unauthenticated anonymous users cannot trigger this without at least low-privilege credentials; the impact is availability-only with no data exfiltration path; and the attack affects only the single Perspective server process, not the underlying host or other services. The single-threaded IOLoop architecture means that even one such request fully denies service to all clients simultaneously.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) scores 7.1 and accurately reflects the threat profile: network-reachable, low complexity, no special attack requirements, but requiring low-privilege access (PR:L). The availability impact is high against the vulnerable system only - confidentiality and integrity are not affected. The primary risk amplifier is the publicly available proof-of-concept exploit, which lowers the barrier to exploitation significantly and makes this a credible, near-term threat for any internet- or intranet-exposed Perspective deployment. The DoS is complete and affects all concurrent clients, not just the attacker's session, meaning a single low-privileged user can perform a multi-tenant denial of service. No EPSS data was provided in the input; exploitation probability cannot be independently confirmed from available data. No CISA KEV listing is present, so active exploitation in the wild is not confirmed. The combination of a public POC, network accessibility, and low-privilege requirement makes this a real operational priority despite the absence of KEV status.

An attacker with low-privilege access to a Perspective server - such as a normal user account in a shared analytics platform - crafts a TableMakeViewReq message specifying a computed expression column containing a while(true) or for loop with a very large iteration bound. Upon submission, the server begins evaluating the expression row-by-row against the table with no timeout or yield point, permanently blocking the Tornado IOLoop and making the server unresponsive to all other connected clients. A public proof-of-concept exploit exists per VulnCheck's disclosure, meaning this attack requires minimal reverse engineering.