Scriban versions 3.x are vulnerable to a denial of service attack that can be exploited by unauthenticated actors to crash the application.

This flaw relates to CWE-770: Allocation of Resources Without Limits or Throttling. An unauthenticated attacker can supply crafted array multiplication inputs that cause the application to consume excessive system memory or CPU cycles.

A successful exploit leads to a denial of service, causing system instability or complete application failure. With a CVSS score of 7.5, this vulnerability represents a high risk to availability, which could lead to significant service outages for dependent business applications.

Immediate Action: Update the Scriban NuGet package to version 7.2.1 or later to resolve the underlying resource management flaw.

Proactive Monitoring: Analyze application logs for frequent crashes or latency spikes occurring during template processing tasks.

Compensating Controls: Deploy a Web Application Firewall to detect and block requests containing unusually large or complex array structures in template inputs.

Public Exploit Available: Unknown

All systems using the Scriban library must be updated to version 7.2.1 immediately to patch this vulnerability. Proactive patching is essential to prevent potential service disruption caused by malicious actors leveraging this resource exhaustion flaw.