CVE-2026-57576plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length
Updated under an hour ago ()
Does this affect you?
It affects plone.app.dexterity and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0 through 4.0.9, and 5.0.0 are vulnerable to denial of service because an authenticated user can create content with excessively long titles, descriptions, or uploaded-file names, causing Plone to become unresponsive and potentially making the resulting content difficult to edit or delete. The vulnerability is patched in plone.app.dexterity versions 3.2.3, 4.1.3, and 5.0.1, and in plone.app.contenttypes versions 3.0.12, 4.0.10, and 5.0.1.
- CVSS
- 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-400
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Awaiting Analysis
- Record last updated
- Sep 26, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
plone plone.app.dexterity plone:plone.app.dexterity (from the name) | = 5.0.0; from 4.0.0, < 4.1.3; before 3.2.3 | CNA record |
plone plone.app.contenttypes plone:plone.app.contenttypes (from the name) | = 5.0.0; from 4.0.0, < 4.0.10; before 3.0.12 | CNA record |
References
- https://github.com/plone/plone.app.dexterity/security/advisories/GHSA-5426-92w4-wvhvx-refsource-confirm
- https://github.com/plone/plone.app.contenttypes/security/advisories/GHSA-8pcw-h6w9-h46gx-refsource-misc
- https://github.com/plone/plone.app.contenttypes/commit/13dc98a578341aac24a1e65fd9bc7ac8a07d168ax-refsource-misc
- https://github.com/plone/plone.app.contenttypes/commit/21bae6ebe424689eeac9a5884fc0da35f4944e63x-refsource-misc
- https://github.com/plone/plone.app.contenttypes/commit/639c0619f371df578e69ec94e5ca98e60fd6ed58x-refsource-misc
- https://github.com/plone/plone.app.contenttypes/commit/7bb03e8ec6c6bd0e645f445b0755e85a51afb158x-refsource-misc
- https://github.com/plone/plone.app.contenttypes/commit/bed1547d4f8b1fc995f2c76f30ba5f20276a8ad6x-refsource-misc
- https://github.com/plone/plone.app.dexterity/commit/0d317df663823445200d0569a66a95b7e4a9c50dx-refsource-misc
- https://github.com/plone/plone.app.dexterity/commit/2fdceb120ca86682a408f3a14753cfcf5126d9d9x-refsource-misc
- https://github.com/plone/plone.app.dexterity/commit/411689047f9a3521899ae6992a9b0efbd0592a8fx-refsource-misc
- https://github.com/plone/plone.app.dexterity/commit/cbcef731c0882146b9bf30688cdc639d879878fbx-refsource-misc
- https://github.com/plone/plone.app.dexterity/commit/f3596538cf7670bb8bc27b0dfa0b1da41c8b8a3ax-refsource-misc
- https://github.com/plone/plone.app.dexterity/commit/fb45bfdb18f1dfb3ed55e477947a3df9a6ee9e20x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.