Quick answers
- Is CVE-2026-123660 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-123660 being exploited in the wild.
- How severe is CVE-2026-123660?
- Informational severity, published 6 November 2026.
- Which products and versions are affected?
- Vulnerability Lookup 5.5.1 to 6.4.0.
- Is there a fix for CVE-2026-123660?
- Yes: fixed in Vulnerability-Lookup 6.4.1. Until then: Restrict user registration or webhook notification creation to trusted administrators until the application can be updated to version 6.4.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-123660 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-123660?
- Check whether you run Vulnerability Lookup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Vulnerability-Lookup 6.4.1
Restrict user registration or webhook notification creation to trusted administrators until the application can be updated to version 6.4.1.
Technical details
The vulnerability exists in webhook payload template rendering, where Python's string formatting operations directly process user-supplied format specifiers without bounds checking. Format specifiers like "{title:>999999999}" cause the formatter to allocate a 1 GB padded string before size validation occurs. Authenticated attackers can exhaust worker memory both during template save (which test-renders the template) and during each webhook delivery, or craft deeply nested templates that trigger unhandled recursion errors. Version 6.4.1 mitigates this by capping format specifier numbers at 256, limiting rendered output to 1 MB, and rejecting templates nested deeper than 32 levels.
Affected products
- Vulnerability-Lookup Vulnerability-Lookup 5.5.1 to 6.4.0
Timeline
- 2026-11-06: disclosed
- 2026-11-06: patched: Fix commit 2076ffd released in version 6.4.1