CVE-2026-67199: Perspective 5.0.0 DoS Vulnerability

CVE-2026-67199 Overview

CVE-2026-67199 is a denial-of-service vulnerability in Perspective 5.0.0. Remote attackers can block the server event loop indefinitely by submitting a crafted expression to a TableMakeViewReq message. The expression contains unbounded for or while loop constructs with arbitrarily large iteration counts. Perspective evaluates the expression once per table row without any iteration cap, deadline, or cancellation check. The Tornado IOLoop blocks during evaluation, rendering the server unresponsive to all connected clients. The weakness is classified as Allocation of Resources Without Limits or Throttling [CWE-770].

Critical Impact
A single authenticated request can freeze the Perspective server event loop, denying service to every connected client until the process is restarted.

Affected Products

Perspective 5.0.0

Discovery Timeline

2026-08-04 - CVE-2026-67199 published to the National Vulnerability Database (NVD)
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-67199

Vulnerability Analysis

Perspective accepts expression columns inside TableMakeViewReq messages. The expression engine executes user-supplied code once per row. When the expression contains a for or while loop, the engine iterates the loop body to completion before returning control to the caller.

The engine does not enforce a maximum iteration count. It does not check a deadline between iterations. It does not test a cancellation token that would let the server abort long-running evaluations. As a result, an attacker who supplies a large iteration bound forces synchronous CPU work inside the single-threaded event loop.

Because Perspective runs on Tornado's IOLoop, blocking the loop stops all I/O for the process. Every WebSocket client stalls until the loop resumes. The attack requires only low-privilege access to submit a table view request.

Root Cause

The root cause is missing resource governance on expression evaluation. The expression evaluator trusts loop bounds supplied by the client. It runs synchronously on the same thread that services network I/O, so any long-running expression starves the event loop of scheduling time.

Attack Vector

An authenticated attacker sends a TableMakeViewReq message containing an expression column with a loop such as for (i := 0; i < 10_000_000_000; i += 1) { ... }. When Perspective evaluates the expression against the target table, the server thread executes the loop to completion. See the VulnCheck Security Advisory and the Christ Bowel Blog Post for full reproduction details.

Detection Methods for CVE-2026-67199

Indicators of Compromise

Perspective server processes with sustained 100% CPU on a single core while unresponsive to WebSocket pings.
TableMakeViewReq messages containing expression columns with for or while constructs and large numeric literals.
Client-side timeouts and dropped WebSocket connections that correlate to a specific authenticated session.

Detection Strategies

Inspect Perspective WebSocket traffic for TableMakeViewReq payloads and parse the expression column for loop keywords and high iteration bounds.
Instrument the Tornado IOLoop with a slow-callback logger and alert when a single callback exceeds a defined threshold.
Correlate authenticated session identifiers with sudden drops in throughput or heartbeat responses.

Monitoring Recommendations

Track per-session request rates and expression column length against historical baselines.
Export process-level CPU and event-loop lag metrics from every Perspective host into your SIEM or data lake.
Retain WebSocket frames for forensic replay so that a suspect expression can be reconstructed after an outage.

How to Mitigate CVE-2026-67199

Immediate Actions Required

Restrict TableMakeViewReq access to trusted, authenticated users and remove anonymous or shared credentials.
Place Perspective behind a reverse proxy that enforces short request timeouts and terminates stalled WebSocket sessions.
Filter or reject expression payloads that contain for or while constructs until a patched build is deployed.

Patch Information

No vendor patch is referenced in the NVD entry at publication time. Monitor the VulnCheck Security Advisory and upstream Perspective releases for a fixed version that adds iteration caps, deadlines, or cancellation checks to the expression evaluator.

Workarounds

Disable expression columns for untrusted tenants where the feature is not required.
Run Perspective in a resource-limited container with strict CPU quotas so that a blocked event loop cannot starve neighboring services.
Deploy a WebSocket-aware proxy rule that inspects TableMakeViewReq payloads and rejects expressions matching loop patterns.

bash

# Example nginx location block to enforce short WebSocket timeouts for Perspective
location /websocket {
    proxy_pass http://perspective_upstream;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 15s;
    proxy_send_timeout 15s;
}