CVE-2026-55254 Overview
CVE-2026-55254 is a denial-of-service vulnerability in NCalc, a fast, lightweight expression evaluator for .NET. The flaw resides in the factorial operator implementation in src/NCalc.Core/Helpers/MathHelper.cs. Specially crafted expressions containing extremely large factorial operands trigger an integer overflow in the calculation logic. This causes excessive CPU consumption or a non-terminating loop when applications evaluate untrusted expressions. The issue affects all NCalc versions prior to 6.1.1 and is classified under [CWE-190] Integer Overflow or Wraparound. Maintainers fixed the flaw in version 6.1.1.
Critical Impact
Attackers who can submit expressions to a vulnerable NCalc consumer can exhaust CPU resources and stall application threads, degrading service availability.
Affected Products
- NCalc expression evaluator for .NET, all versions prior to 6.1.1
- .NET applications that evaluate untrusted user-supplied expressions through NCalc
- Downstream libraries and services that embed vulnerable NCalc builds
Discovery Timeline
- 2026-07-17 - CVE-2026-55254 published to the National Vulnerability Database
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-55254
Vulnerability Analysis
NCalc parses and evaluates mathematical expressions supplied as strings, including the factorial operator (!). The factorial routine in MathHelper.cs iterates to compute the product of successive integers. When an attacker supplies an operand large enough to overflow the loop counter or the accumulating product, the internal state wraps around. The loop termination condition no longer holds, producing either an extremely long-running computation or a non-terminating loop. The thread executing the expression consumes a full CPU core and never returns control to the caller.
Root Cause
The underlying defect is an integer overflow in the factorial calculation path. The implementation does not validate the operand against a safe maximum before entering the multiplication loop and does not detect wraparound of the accumulator. Because .NET integer arithmetic silently wraps in unchecked contexts, an overflow flips the sign or resets the value, breaking the loop exit condition and producing runaway execution.
Attack Vector
An attacker submits an expression such as a very large numeric literal followed by the factorial operator to any interface that forwards untrusted input into Evaluate(). Exploitation requires user interaction and adjacent network access, and it impacts availability only. Confidentiality and integrity are not affected. Each malicious expression can tie up a worker thread, so repeated submissions can drive an application to full CPU saturation. See the GitHub Security Advisory GHSA-3w5p-95mh-gq75 and Pull Request #575 for the technical fix details.
Detection Methods for CVE-2026-55254
Indicators of Compromise
- Expression payloads containing large numeric operands immediately followed by the factorial operator (!), for example values in the millions or higher.
- Application threads stuck inside NCalc.Core.Helpers.MathHelper factorial routines visible in stack traces or thread dumps.
- Sustained single-core CPU saturation coincident with requests that route into NCalc Evaluate() calls.
Detection Strategies
- Inspect application logs and request payloads for expression strings containing ! combined with unusually large integer literals.
- Instrument NCalc callers with per-evaluation timeouts and log any expression that exceeds the threshold for later analysis.
- Use process telemetry to correlate long-running .NET threads with the NCalc assembly and specific request identifiers.
Monitoring Recommendations
- Track CPU utilization per worker or container hosting the NCalc-consuming service and alert on sustained saturation.
- Monitor request latency and thread-pool starvation metrics for services that accept user-supplied formulas or expressions.
- Enable dependency scanning in CI pipelines to flag any project referencing NCalc versions below 6.1.1.
How to Mitigate CVE-2026-55254
Immediate Actions Required
- Upgrade all NCalc references to version 6.1.1 or later, as published in the GitHub Release v6.1.1.
- Audit application code paths that pass untrusted input into NCalc Evaluate() and enforce input length and character restrictions.
- Wrap NCalc evaluation in a cancellable task with a strict timeout to bound worst-case CPU usage.
Patch Information
The fix is delivered in NCalc 6.1.1. The upstream change is available in the GitHub Commit eeb6155 and merged via Pull Request #575. Update the NCalc NuGet package reference and rebuild affected .NET applications. Verify transitive dependencies to ensure no older NCalc build is loaded at runtime.
Workarounds
- Reject expressions containing the factorial operator (!) at the input validation layer when factorial support is not required.
- Cap the numeric range of any operand accepted from untrusted sources before evaluation.
- Execute NCalc evaluations on isolated worker threads with a CancellationToken and hard timeout, terminating stuck evaluations.
# Configuration example: upgrade NCalc via .NET CLI
dotnet add package NCalc --version 6.1.1
dotnet restore
dotnet build --configuration Release
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
