Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-123660— Vulnerability-Lookup: memory amplification through webhook payload template format specifiers

Quick assessment

Affected
vulnerability-lookup vulnerability-lookup
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Vulnerability-Lookup 5.5.1 至 6.4.1（不含 6.4.1）版本中，已登录用户可利用 webhook 通知的负载模板，诱导服务器分配与其输入量严重不成比例的大量内存。具体而言，每个占位符的格式说明符被原样传递给 Python 的字符串格式化函数，而该函数会在检查最终字符串大小之前先构建填充后的结果。因此，一个仅几十字节的模板（例如 ）在保存时触发通知表单的测试渲染，便会生成约 1GB 的字符串；若重复使用此类字段，则成本成倍增加。此外，即使模板通过了保存时的检查，也可能包含数千次重复

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-123660

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Vulnerability-Lookup: memory amplification through webhook payload template format specifiers
Source: CVE Program / CVE List V5
Vulnerability Description
In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input through a webhook notification's payload template. Each placeholder's format specifier was passed unchanged to Python's string formatting, which builds the padded result before its size can be checked. A template of a few dozen bytes, such as {"text": "{title:>999999999}"}, therefore produced a string of about 1 GB when the notification form test-rendered it on save, and repeating such fields multiplied the cost. Templates that passed the save check could also repeat placeholders such as {text} thousands of times; the notification daemon rebuilt those on every webhook delivery. Deeply nested templates raised an unhandled recursion error (HTTP 500). An attacker needs only an account, which the default configuration lets anyone create after e-mail confirmation. They could exhaust the memory of web workers or the notification daemon, causing a denial of service. Version 6.4.1 caps every number in a format specifier at 256, limits a rendered template to 1,000,000 characters both on save and at delivery, and rejects templates nested deeper than 32 levels.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
vulnerability-lookup vulnerability-lookup 5.5.1 ~ 6.4.1 -

II. Public POCs for CVE-2026-123660

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-123660

请登录查看更多情报信息。

Other References for CVE-2026-123660 (1)

IV. Related Vulnerabilities

Same product: vulnerability-lookup
Same vendor: vulnerability-lookup
Same weakness: CWE-770