CVE-2026-57576

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57576
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57576.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57576
Aliases
Related
GHSA (2)
Published
2026-09-22T23:01:22Z
Modified
2026-09-24T03:45:35Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length
Details

plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0 through 4.0.9, and 5.0.0 are vulnerable to denial of service because an authenticated user can create content with excessively long titles, descriptions, or uploaded-file names, causing Plone to become unresponsive and potentially making the resulting content difficult to edit or delete. The vulnerability is patched in plone.app.dexterity versions 3.2.3, 4.1.3, and 5.0.1, and in plone.app.contenttypes versions 3.0.12, 4.0.10, and 5.0.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-400"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57576.json"
}
References

Affected packages

Git / github.com/plone/plone.app.contenttypes

Affected ranges

Type
GIT
Repo
https://github.com/plone/plone.app.contenttypes
Events
Introduced
88b8674c7ecf818fc619a8d986aae2aefb7a672b
Fixed
97e72ab08e3bec8f9b2409e970c1c2c7ec53088b
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7816918e5c60348cca307e9571dc0ea01d82da42
Introduced
a120e561f36bfae9463e7029c85dd34544e6cce0
Last Affected
a120e561f36bfae9463e7029c85dd34544e6cce0
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "4.0.10"
        },
        {
            "introduced":  "0"
        },
        {
            "fixed":  "3.0.12"
        },
        {
            "introduced":  "= 5.0.0"
        },
        {
            "last_affected":  "= 5.0.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}
Type
GIT
Repo
https://github.com/plone/plone.app.dexterity
Events
Introduced
f9b1605bae97e858c22e9e7f25c174cc1676270f
Fixed
b08c45a491b34a7f9e9902416a89302f3b5e2f15
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a90bfd861580f012ab41d3093ff8d8065920c018
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "4.1.3"
        },
        {
            "introduced":  "0"
        },
        {
            "fixed":  "3.2.3"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*
1.0
1.0b1
1.0b2
1.0b2-thorn1
1.0b2-thorn2
1.0b3
1.0b4
1.0rc1
1.2.0
1.2.1
1.2.10
1.2.11
1.2.12
1.2.13
1.2.14
1.2.15
1.2.16
1.2.17
1.2.18
1.2.19
1.2.2
1.2.20
1.2.21
1.2.22
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.2a2
1.2a3
1.2a4
1.2a5
1.2a6
1.2a8
1.2a9
1.2b1
1.2b2
1.2b3
1.2b4
1.3.0
1.4
1.4.1
1.4.10
1.4.11
1.4.12
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
2.*
2.0
2.0.0
2.0.1
2.0.10
2.0.11
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.1
2.1.10
2.1.11
2.1.12
2.1.13
2.1.14
2.1.15
2.1.16
2.1.17
2.1.18
2.1.19
2.1.2
2.1.20
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.2.0
2.2.1
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.4.0
2.4.1
2.4.10
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.4.7
2.4.8
2.4.9
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
3.*
3.0.0
3.0.0a1
3.0.0a10
3.0.0a11
3.0.0a12
3.0.0a13
3.0.0a2
3.0.0a3
3.0.0a4
3.0.0a5
3.0.0a6
3.0.0a7
3.0.0a8
3.0.0a9
3.0.0b1
3.0.0b2
3.0.1
3.0.10
3.0.11
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.1.0
3.1.1
3.1.2
3.2.0
3.2.1
3.2.2
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.2
5.*
5.0.0
= 5.*
= 5.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57576.json"