Executive brief
plone.app.dexterity is a content management component used in Plone CMS to define and manage content types and their fields. An attacker with low privileges can create content with excessively long title or description fields, causing the Plone server to become unresponsive and making affected content difficult to edit or delete, resulting in denial of service to legitimate users.
Technical details
This is an uncontrolled resource consumption vulnerability (CWE-400) in plone.app.dexterity's handling of title and description fields. When content is created with extremely large values in these fields, the application fails to properly validate or limit field length, causing excessive memory or processing resource consumption. An authenticated user (low privilege required) can trigger this via the network without user interaction. The result is server unresponsiveness and UI degradation, preventing normal content management operations. Patches are available in versions 5.0.1 (for Plone 6.2), 4.1.3 (for Plone 6.1), and 3.2.3 (for Plone 6.0).
Affected products
- Plone plone.app.dexterity 5.0.0; 4.0.0 to 4.1.2; up to 3.2.2
Timeline
- 2026-06-23: disclosed
- 2026-09-23: advisory