Executive brief
Perspective is an interactive analytics and data visualization platform used in internal dashboards at financial institutions. A denial-of-service vulnerability allows remote attackers with basic access to block the server indefinitely by submitting a crafted expression containing unbounded loops, rendering the entire service unresponsive to all connected users.
Technical details
The vulnerability exists in Perspective 5.0.0's expression column evaluation mechanism, which processes user-supplied formulas on a per-row basis within TableMakeViewReq messages. Attackers can craft expressions containing unbounded for or while loops with arbitrarily large iteration counts. When evaluated, these expressions block the Tornado IOLoop without any iteration cap, deadline, or cancellation mechanism (CWE-770: Allocation of Resources Without Limits or Throttling). The attack requires authenticated access (PR:L) but causes server-wide unavailability. No patch information is currently available.
Affected products
- Perspective Perspective 5.0.0
Timeline
- 2026-08-04: disclosed
- 2026-08-04: advisory