Memory Exhaustion Vulnerability in Vulnerability-Lookup by Vulnerability-Lookup
CVE-2026-123660

5.3MEDIUM

Key Information:

Vendor

Vulnerability-lookup

Status
Vulnerability-lookup
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123660?

In versions prior to 6.4.1 of Vulnerability-Lookup, a vulnerability allows signed-in users to exploit webhook notification templates, causing excessive memory allocation due to uncontrolled input size. Maliciously crafted payloads can lead to a denial of service by exhausting server resources. This vulnerability arises because format specifiers are processed without checks, and templates can be deeply nested, leading to recursion errors. The latest version addresses these issues by imposing character limits and nesting restrictions.

Affected Version(s)

vulnerability-lookup 5.5.1 < 6.4.1

References

https://github.com/vulnerability-lookup/vulnerability-loo...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matteo Panzeri (UniversitĂ  di Pavia), GitHub @matte1782
Claude Opus 5
CĂ©dric Bonhomme
.