CVE-2026-57576: Plone CMS Denial of Service Vulnerability

CVE-2026-57576 Overview

CVE-2026-57576 is a denial-of-service vulnerability affecting plone.app.dexterity and plone.app.contenttypes, two core components of the Plone content management system. An authenticated user can create content with excessively long titles, descriptions, or uploaded-file names. Processing this oversized input causes Plone to become unresponsive, and the resulting content is difficult to edit or delete afterward. The flaw is classified as uncontrolled resource consumption [CWE-400] and requires only low-privilege authenticated access over the network.

Critical Impact
An authenticated Plone user can render the site unresponsive by submitting content with unbounded title, description, or filename values, causing service disruption and persistent content that resists remediation.

Affected Products

plone.app.dexterity through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0
plone.app.contenttypes through 3.0.11, 4.0.0 through 4.0.9, and 5.0.0
Plone CMS deployments using Dexterity-based content types

Discovery Timeline

2026-09-22 - CVE-2026-57576 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-57576

Vulnerability Analysis

The vulnerability stems from missing length constraints on user-controllable string fields in Dexterity-based content types. When an authenticated user submits a title, description, or uploaded file with an extremely long name, Plone accepts the value without enforcing an upper bound. Downstream processing, indexing, and rendering of that content consume disproportionate CPU and memory, causing request timeouts and site unresponsiveness.

The issue compounds itself: once oversized content is stored, subsequent operations that touch the object (listings, edit forms, catalog queries, deletion attempts) trigger the same expensive processing. This makes the resulting content difficult to edit or delete through normal administrative interfaces.

Root Cause

The root cause is the absence of a max_length constraint on the zope.schema.TextLine title field and the zope.schema.Text description field in the Dexterity content type schemas. In plone.app.contenttypes, the set_title_description subscriber in subscribers.py also copied uploaded filenames into the object title without truncation. No validation layer bounded the string size before persistence or before catalog indexing.

Attack Vector

Exploitation requires network access and a low-privilege authenticated account with permission to create or edit content. The attacker submits a title, description, or file upload containing an oversized string. No user interaction from an administrator is required. The impact is limited to availability; the vulnerability does not disclose data or allow modification of unrelated content.

python

# Patch from src/plone/app/contenttypes/subscribers.py
 from plone.app.contenttypes.interfaces import IImage

+try:
+    from plone.app.dexterity.config import MAX_TITLE_LENGTH as _MAX_TITLE_LENGTH
+except ImportError:
+    _MAX_TITLE_LENGTH = 1024
+

 def set_title_description(obj, event):
     """Sets title to filename if no title"""

Source: Plone Commit 13dc98a

The schema-level fix in src/plone/app/contenttypes/schema/file.xml introduces explicit length caps:

xml

            type="zope.schema.TextLine"
     >
       <description />
+      <max_length>1024</max_length>
       <required>False</required>
       <title i18n:translate="">Title</title>
     </field>
     <field name="description"
            type="zope.schema.Text"
     >
       <description />
+      <max_length>10000</max_length>
       <required>False</required>
       <title i18n:translate="">Description</title>
     </field>

Source: Plone Commit 21bae6e

Detection Methods for CVE-2026-57576

Indicators of Compromise

Plone content objects with title fields larger than 1024 characters or descriptions larger than 10000 characters.
Uploaded files with abnormally long filenames stored as object titles.
Recurring Zope worker timeouts or worker restarts correlated with authenticated content-creation requests.
Sustained high CPU usage tied to catalog reindex operations on a small set of recently created objects.

Detection Strategies

Audit the Plone catalog (portal_catalog) for objects whose Title or Description metadata exceeds the post-patch limits.
Review web server access logs for POST requests to content-creation and file-upload endpoints with unusually large request bodies from low-privilege accounts.
Correlate authentication events with subsequent worker unresponsiveness to identify accounts creating oversized content.

Monitoring Recommendations

Monitor Zope/WSGI worker process latency and memory footprint, alerting when render times for a single object exceed normal thresholds.
Track content-creation events per authenticated user and flag accounts that create content with fields near the maximum allowed size.
Ingest Plone application logs into a centralized log platform to preserve evidence of pre-patch abuse.

How to Mitigate CVE-2026-57576

Immediate Actions Required

Upgrade plone.app.dexterity to 3.2.3, 4.1.3, or 5.0.1 depending on the deployed major version.
Upgrade plone.app.contenttypes to 3.0.12, 4.0.10, or 5.0.1 depending on the deployed major version.
Review and restrict the Contributor and content-creation roles to trusted accounts until patches are applied.
Identify and remove any pre-existing oversized content objects that may already be degrading site responsiveness.

Patch Information

The fix is available in plone.app.dexterity versions 3.2.3, 4.1.3, and 5.0.1, and in plone.app.contenttypes versions 3.0.12, 4.0.10, and 5.0.1. The patches introduce a MAX_TITLE_LENGTH of 1024 characters and a maximum description length of 10000 characters, enforced through the schema max_length constraint and the set_title_description subscriber. Full details are documented in Plone Security Advisory GHSA-8pcw-h6w9-h46g and Plone Dexterity Advisory GHSA-5426-92w4-wvhv.

Workarounds

Place a reverse proxy in front of Plone and enforce a strict client_max_body_size (or equivalent) to reject oversized request bodies.
Add a custom form validator that rejects title and description submissions exceeding the patch-defined limits.
Temporarily reduce the number of accounts holding content-creation permissions until upgrades are completed.

bash

# Upgrade example using pip
pip install --upgrade \
  "plone.app.dexterity>=5.0.1" \
  "plone.app.contenttypes>=5.0.1"

# Verify installed versions
pip show plone.app.dexterity | grep Version
pip show plone.app.contenttypes | grep Version