Executive brief
Perspective is an analytics and data visualization engine used in internal dashboards at banks and trading desks. An unauthenticated attacker can crash the server by sending specially crafted protocol messages with missing fields, causing a denial of service that disrupts availability of the analytics platform.
Technical details
The vulnerability exists in the VirtualServer protocol dispatcher's handling of protobuf messages. Attackers can send well-formed but incomplete protobuf messages (such as ViewToArrowReq without a viewport or MakeTableReq without a data field) that trigger unwrap() calls on None values at nine distinct code locations, causing the process to abort with SIGABRT. The attack requires no authentication and is reachable over the network through the WebSocket protocol. The flaw allows any remote attacker to repeatedly crash the server process, resulting in denial of service. A fix would involve proper null checking and error handling before calling unwrap() on optional protobuf fields.
Affected products
- Perspective Perspective 5.0.0
Timeline
- 2026-08-04: disclosed
- 2026-08-04: advisory