A resource exhaustion vulnerability in the Scriban templating engine allows unauthenticated attackers to crash applications via excessive memory allocation.

This issue stems from the lack of limits on resource allocation (CWE-770) during string pad operations. Unauthenticated attackers can leverage this to force the application to consume excessive memory.

Exploitation of this vulnerability leads to a denial of service, causing system instability or application crashes. A CVSS score of 7.5 underscores the high risk to service availability, which can lead to significant downtime for any business infrastructure relying on the vulnerable component.

Immediate Action: Update the Scriban or Scriban.Signed NuGet packages to version 7.0.0 or later.

Proactive Monitoring: Monitor application memory usage metrics for abnormal spikes that coincide with template processing tasks.

Compensating Controls: Deploy a Web Application Firewall to inspect and block excessively large or malformed input strings directed at template rendering endpoints.

Public Exploit Available: Unknown.

Security teams should ensure that all instances of the Scriban library are updated to version 7.0.0 immediately. This update introduces necessary resource constraints to prevent uncontrolled memory allocation.