High
Perspective 5.0.0 DoS via VirtualServer Protocol Dispatcher
Type: advisorySources: OSV
Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with no viewport set or MakeTableReq with no data field to trigger unwrap() calls on None values at nine distinct sites, causing the process to abort with SIGABRT.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-67198
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 17:39 UTC · Revision 1
Source evidence
Perspective 5.0.0 DoS via VirtualServer Protocol Dispatcher
core-osv · Original sourcePublished 4 Aug 2026, 14:04 UTC
Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with no viewport set or MakeTableReq with no data field to trigger unwrap() calls on None values at nine distinct sites, causing the process to abort with SIGABRT.
osv:CVE-2026-67198
Complete source record
{
"id": "7fb53facb46caf1f3179f7b1575decb0ee89d26f8c80b710411f15b370e0b935",
"url": "https://osv.dev/vulnerability/CVE-2026-67198",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Perspective 5.0.0 DoS via VirtualServer Protocol Dispatcher",
"summary": "Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with no viewport set or MakeTableReq with no data field to trigger unwrap() calls on None values at nine distinct sites, causing the process to abort with SIGABRT.",
"evidence": "osv:CVE-2026-67198",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-67198",
"aliases": [
"CVE-2026-67198"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/perspective-dev/perspective",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "f0a4f5b327942c64edbc53b60655007b147ff6cc"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "5.0.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
}
],
"versions": [
"v5.0.0",
"v4.5.2",
"v4.5.1",
"v4.5.0",
"v4.4.1",
"v4.4.0",
"v4.3.0",
"v4.2.0",
"v4.1.1",
"v4.1.0",
"v4.0.1",
"v4.0.0",
"v3.8.0",
"v3.7.4",
"v3.7.3",
"v3.7.2",
"v3.7.1",
"v3.7.0",
"v3.6.1",
"v3.6.0",
"v3.5.1",
"v3.5.0",
"v3.4.3",
"v3.4.2",
"v3.4.1",
"v3.4.0",
"v3.3.4",
"v3.3.3",
"v3.3.2",
"v3.3.1",
"v3.3.0",
"v3.2.1",
"v3.2.0",
"v3.1.8",
"v3.1.7",
"v3.1.6",
"v3.1.5",
"v3.1.4",
"v3.1.3",
"v3.1.2",
"v3.1.1",
"v3.1.0",
"v3.0.3",
"v3.0.2",
"v3.0.1",
"v3.0.0",
"v2.10.1",
"v2.10.0",
"v2.9.0",
"v2.8.1",
"v2.8.0",
"v2.7.1",
"v2.7.0",
"v2.6.1",
"v2.6.0",
"v2.5.2",
"v2.5.1",
"v2.5.0",
"v2.4.0",
"v2.3.2",
"v2.3.1",
"v2.3.0",
"v2.2.1",
"v2.2.0",
"v2.1.4",
"v2.1.3",
"v2.1.2",
"v2.1.1",
"v2.1.0",
"v2.0.1",
"v2.0.0",
"v1.9.4",
"v1.9.3",
"v1.9.2",
"v1.9.1",
"v1.9.0",
"v1.8.1",
"v1.8.0",
"v1.7.2",
"v1.7.1",
"v1.7.0",
"v1.6.5",
"v1.6.4",
"v1.6.3",
"v1.6.2",
"v1.6.1",
"v1.6.0",
"v1.5.1",
"v1.5.0",
"v1.4.1",
"v1.4.0",
"v1.3.13",
"v1.3.12",
"v1.3.11",
"v1.3.10",
"v1.3.9",
"v1.3.8",
"v1.3.7",
"v1.3.6",
"v1.3.5",
"v1.3.4",
"v1.3.3",
"v1.3.2",
"v1.3.1",
"v1.3.0",
"v1.2.0",
"v1.1.1",
"v1.1.0",
"v1.0.8",
"v1.0.6",
"v1.0.7",
"v1.0.5",
"v1.0.4",
"v1.0.3",
"v1.0.2",
"v1.0.1",
"v1.0.0-rc.2",
"v1.0.0",
"v1.0.0-rc.1",
"v1.0.0-rc.0",
"v0.10.3",
"v0.10.2",
"v0.10.1",
"v0.10.0",
"v0.9.0",
"v0.8.3",
"v0.8.2",
"v0.8.1",
"v0.8.0",
"v0.7.0",
"v0.6.2",
"v0.6.1",
"v0.6.0",
"v0.5.6",
"v0.5.5",
"v0.5.3",
"v0.5.2",
"v0.5.1",
"v0.5.0",
"v0.4.8",
"v0.4.7",
"v0.4.6",
"v0.4.5",
"v0.4.4",
"v0.4.3",
"v0.4.2",
"v0.4.1",
"v0.4.0",
"v0.4.0-rc.6",
"v0.4.0-rc.5",
"v0.4.0-rc.4",
"v0.4.0-rc.3",
"v0.4.0-rc.2",
"v0.4.0-rc.1",
"v0.3.9",
"v0.3.8",
"v0.3.7",
"v0.3.6",
"v0.3.5",
"v0.3.4",
"v0.3.3",
"v0.3.2",
"v0.3.1",
"v0.3.0",
"v0.3.0-rc.4",
"v0.3.0-rc.3",
"v0.3.0-rc.2",
"v0.3.0-rc.1",
"v0.2.23",
"v0.2.22",
"v0.2.21",
"v0.2.20",
"v0.2.19",
"v0.2.18",
"v0.2.17",
"v0.2.16",
"v0.2.15",
"v0.2.14",
"v0.2.13",
"v0.2.12",
"v0.2.11",
"v0.2.10",
"v0.2.9",
"v0.2.8",
"v0.2.7",
"v0.2.6",
"v0.2.5",
"v0.2.4",
"v0.2.3",
"v0.2.2",
"v0.2.1",
"v0.2.0",
"v0.2.0-beta.3",
"0.2.0-beta.3",
"v0.2.0-beta.2",
"v0.2.0-beta.1",
"v0.1.18",
"v0.1.17",
"v0.1.16",
"v0.1.15",
"v0.1.14",
"v0.1.13",
"v0.1.12",
"v0.1.11",
"v0.1.10",
"v0.1.9",
"v0.1.8",
"v0.1.7",
"v0.1.6",
"v0.1.5",
"v0.1.4",
"v0.1.3",
"v0.1.2",
"v0.1.1",
"v0.1.0",
"v0.0.2",
"v0.0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67198.json"
}
}
],
"modified": "2026-10-28T02:30:37.899204448Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67198.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-67198",
"https://www.vulncheck.com/advisories/perspective-dos-via-virtualserver-protocol-dispatcher",
"https://github.com/perspective-dev/perspective",
"https://christbowel.com/blog/perspective-5-0-0-five-cves/"
],
"provider_metadata": {
"cwe_ids": [
"CWE-616"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67198.json"
}
},
"related_cves": [
{
"value": "CVE-2026-67198",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 505394,
"published_at": "2026-08-04T14:04:00.388+00:00"
}