Harttle
Monthly
Memory accounting bypass in LiquidJS prior to 10.27.2 enables remote denial of service by exhausting V8 heap or process memory limits through crafted templates. The join, array_to_sentence_string, json, and inspect filters computed resource consumption based on element count rather than actual output string length, allowing the concat filter to be chained to exponentially amplify array size without proportional memoryLimit charges. This CVE is not in CISA KEV and no standalone public exploit has been published, though the GitHub security advisory and fix PR #925 include working proof-of-concept integration tests that make the technique trivially reproducible.
Infinite-loop denial of service in LiquidJS affects the strip_html filter across versions 10.26.0 through 10.27.0, allowing any caller who can supply template input to permanently block rendering with a string as short as two characters. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) reflects that no authentication or special configuration is needed when the rendering endpoint accepts external input. The issue is fixed in version 10.27.1 via a one-character patch; no public exploit code beyond the patch test cases has been confirmed, and no CISA KEV listing is recorded.
Unbounded memory allocation in LiquidJS pop filter (prior to 10.27.1) allows remote attackers to exhaust server memory by crafting template input that triggers a large array clone without respecting the configured memoryLimit. The vulnerability is automatable, has a publicly available proof-of-concept, but no active exploitation is currently reported.
Memory accounting bypass in LiquidJS prior to 10.27.2 enables remote denial of service by exhausting V8 heap or process memory limits through crafted templates. The join, array_to_sentence_string, json, and inspect filters computed resource consumption based on element count rather than actual output string length, allowing the concat filter to be chained to exponentially amplify array size without proportional memoryLimit charges. This CVE is not in CISA KEV and no standalone public exploit has been published, though the GitHub security advisory and fix PR #925 include working proof-of-concept integration tests that make the technique trivially reproducible.
Infinite-loop denial of service in LiquidJS affects the strip_html filter across versions 10.26.0 through 10.27.0, allowing any caller who can supply template input to permanently block rendering with a string as short as two characters. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) reflects that no authentication or special configuration is needed when the rendering endpoint accepts external input. The issue is fixed in version 10.27.1 via a one-character patch; no public exploit code beyond the patch test cases has been confirmed, and no CISA KEV listing is recorded.
Unbounded memory allocation in LiquidJS pop filter (prior to 10.27.1) allows remote attackers to exhaust server memory by crafting template input that triggers a large array clone without respecting the configured memoryLimit. The vulnerability is automatable, has a publicly available proof-of-concept, but no active exploitation is currently reported.