https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 24 Sep 2026 08:59:53 +0000 https://vulnerability.circl.lu/sighting/87d673df-50da-424f-9c0e-17ba0941d749/export {"uuid": "87d673df-50da-424f-9c0e-17ba0941d749", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57576", "type": "seen", "source": "https://gist.github.com/alon710/596ae516160a36b600032831d0a4ec2c", "content": "# CVE-2026-57576: CVE-2026-57576: Application-Level Denial of Service via Uncontrolled Resource Consumption in Plone\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-57576\n\n## Summary\nCVE-2026-57576 is an application-level Denial of Service (DoS) vulnerability in Plone. It resides in the `plone.app.dexterity` and `plone.app.contenttypes` packages, allowing authenticated users with content creation permissions to submit excessively long metadata attributes. Because these fields are stored without length limits and subsequently processed by indexing and rendering engines, they trigger complete server resource exhaustion and thread starvation.\n\n## TL;DR\nLow-privilege authenticated users can trigger an application-level denial of service in Plone by uploading files with extremely long names or saving excessively long titles and descriptions, leading to database indexing bloat and thread crashes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 6.5\n- **EPSS Score**: 0.00762\n- **EPSS Percentile**: 53.91%\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Plone Content Management System\n- plone.app.dexterity\n- plone.app.contenttypes\n- **plone.app.dexterity**: < 3.2.3 (Fixed in: `3.2.3`)\n- **plone.app.dexterity**: >= 4.0.0, < 4.1.3 (Fixed in: `4.1.3`)\n- **plone.app.dexterity**: = 5.0.0 (Fixed in: `5.0.1`)\n- **plone.app.contenttypes**: < 3.0.12 (Fixed in: `3.0.12`)\n- **plone.app.contenttypes**: >= 4.0.0, < 4.0.10 (Fixed in: `4.0.10`)\n- **plone.app.contenttypes**: = 5.0.0 (Fixed in: `5.0.1`)\n\n## Mitigation\n\n- Upgrade plone.app.dexterity and plone.app.contenttypes to patched versions\n- Apply runtime monkey patches to schema definitions\n- Implement WAF rules limiting POST payload/header size\n- Audit and scrub pre-existing oversized fields in the ZODB\n\n**Remediation Steps:**\n1. Identify the current versions of Plone packages in the buildout configuration.\n2. Update buildout.cfg or requirements.txt to pin plone.app.dexterity to 3.2.3, 4.1.3, or 5.0.1 depending on the release line.\n3. Update plone.app.contenttypes to 3.0.12, 4.0.10, or 5.0.1 depending on the release line.\n4. Run bin/buildout to fetch and install the updated packages.\n5. Restart the Plone/Zope backend servers to load the changes.\n6. Execute a database check to verify no existing objects contain oversized title or description properties.\n\n## References\n\n- [GitHub Security Advisory (plone.app.dexterity)](https://github.com/plone/plone.app.dexterity/security/advisories/GHSA-5426-92w4-wvhv)\n- [GitHub Security Advisory (plone.app.contenttypes)](https://github.com/plone/plone.app.contenttypes/security/advisories/GHSA-8pcw-h6w9-h46g)\n- [Official CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-57576)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-57576)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-57576) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-24T01:31:30.564054Z"} {"uuid": "87d673df-50da-424f-9c0e-17ba0941d749", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57576", "type": "seen", "source": "https://gist.github.com/alon710/596ae516160a36b600032831d0a4ec2c", "content": "# CVE-2026-57576: CVE-2026-57576: Application-Level Denial of Service via Uncontrolled Resource Consumption in Plone\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-57576\n\n## Summary\nCVE-2026-57576 is an application-level Denial of Service (DoS) vulnerability in Plone. It resides in the `plone.app.dexterity` and `plone.app.contenttypes` packages, allowing authenticated users with content creation permissions to submit excessively long metadata attributes. Because these fields are stored without length limits and subsequently processed by indexing and rendering engines, they trigger complete server resource exhaustion and thread starvation.\n\n## TL;DR\nLow-privilege authenticated users can trigger an application-level denial of service in Plone by uploading files with extremely long names or saving excessively long titles and descriptions, leading to database indexing bloat and thread crashes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 6.5\n- **EPSS Score**: 0.00762\n- **EPSS Percentile**: 53.91%\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Plone Content Management System\n- plone.app.dexterity\n- plone.app.contenttypes\n- **plone.app.dexterity**: < 3.2.3 (Fixed in: `3.2.3`)\n- **plone.app.dexterity**: >= 4.0.0, < 4.1.3 (Fixed in: `4.1.3`)\n- **plone.app.dexterity**: = 5.0.0 (Fixed in: `5.0.1`)\n- **plone.app.contenttypes**: < 3.0.12 (Fixed in: `3.0.12`)\n- **plone.app.contenttypes**: >= 4.0.0, < 4.0.10 (Fixed in: `4.0.10`)\n- **plone.app.contenttypes**: = 5.0.0 (Fixed in: `5.0.1`)\n\n## Mitigation\n\n- Upgrade plone.app.dexterity and plone.app.contenttypes to patched versions\n- Apply runtime monkey patches to schema definitions\n- Implement WAF rules limiting POST payload/header size\n- Audit and scrub pre-existing oversized fields in the ZODB\n\n**Remediation Steps:**\n1. Identify the current versions of Plone packages in the buildout configuration.\n2. Update buildout.cfg or requirements.txt to pin plone.app.dexterity to 3.2.3, 4.1.3, or 5.0.1 depending on the release line.\n3. Update plone.app.contenttypes to 3.0.12, 4.0.10, or 5.0.1 depending on the release line.\n4. Run bin/buildout to fetch and install the updated packages.\n5. Restart the Plone/Zope backend servers to load the changes.\n6. Execute a database check to verify no existing objects contain oversized title or description properties.\n\n## References\n\n- [GitHub Security Advisory (plone.app.dexterity)](https://github.com/plone/plone.app.dexterity/security/advisories/GHSA-5426-92w4-wvhv)\n- [GitHub Security Advisory (plone.app.contenttypes)](https://github.com/plone/plone.app.contenttypes/security/advisories/GHSA-8pcw-h6w9-h46g)\n- [Official CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-57576)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-57576)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-57576) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-24T01:31:30.564054Z"} https://vulnerability.circl.lu/sighting/87d673df-50da-424f-9c0e-17ba0941d749/export Thu, 24 Sep 2026 01:31:30 +0000