Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

ncalc.core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.8NuGetPublished

    NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation

    CVE-2026-55254 · GHSA-3w5p-95mh-gq75

    Affected
    • NuGet ncalc.core < 6.1.1
    Fixed in
    6.1.1· Vendor fix available
    Issue
    Impact A denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: Patches The vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) Workarounds If upgrading is not immediately possible: Do not evaluate expressions originating from untrusted users. Validate or sanitize expressions before evaluation and…

    Recommended action: Upgrade to 6.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →