CVE-2026-55254Medium· 4.8▾ SunlitNCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.2%
A denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic.
Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness.
This issue can be triggered with expressions such as:
99999999999999!
9223372036854775807!
1.5e16!
The vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation.
Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+)
If upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability.
NCalc.Core < 6.1.1NCalcSync < 6.1.1Upgrade to a patched release:
NCalc.Core 6.1.1NCalcSync 6.1.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-50142High· 7.5libheif is a HEIF and AVIF file format decoder and encoder
CVE-2026-47857Medium· 5.9In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and ea…
CVE-2026-43618High· 8.1Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receive…
CVE-2026-5121High· 7.5A flaw was found in libarchive
CVE-2026-53705High· 7.6A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good
CVE-2026-52722High· 7.1A signed integer overflow vulnerability was found in GStreamer's VMnc decoder