NCalc.Core
Assembly with the core logic of NCalc.
Activity
- Latest release
- 15h ago
- Total releases
- 44
- Cadence
- ~5 days
- Last 12 months
- 18
Details
- License
- MIT
- First release
- Jun 10, 2024
| Version | Released | |
|---|---|---|
7.0.0
major
|
7.0.0
major
Dependencies (8)
|
|
6.4.0
minor
|
6.4.0
minor
Dependencies (8)
|
|
6.3.3
patch
|
6.3.3
patch
Dependencies (8)
|
|
6.3.2
patch
|
6.3.2
patch
Dependencies (8)
|
|
6.3.1
patch
|
6.3.1
patch
Dependencies (8)
|
|
6.3.0
minor
|
6.3.0
minor
Dependencies (8)
|
|
6.2.0
minor
|
6.2.0
minor
Dependencies (8)
|
|
6.1.1
patch
|
6.1.1
patch
Dependencies (8)
|
|
6.1.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
6.1.0
minor
Dependencies (8)
|
|
6.0.0
major
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
6.0.0
major
Dependencies (8)
|
|
5.13.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.13.0
minor
Dependencies (8)
|
|
5.12.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.12.0
minor
Dependencies (8)
|
|
5.11.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.11.0
minor
Dependencies (8)
|
|
5.10.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.10.0
minor
Dependencies (8)
|
|
5.9.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.9.0
minor
Dependencies (8)
|
|
5.8.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.8.0
minor
Dependencies (8)
|
|
5.7.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.7.0
minor
Dependencies (8)
|
|
5.6.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.6.0
minor
Dependencies (8)
|
|
5.5.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.5.0
minor
Dependencies (8)
|
|
5.4.2
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.4.2
patch
Dependencies (8)
|
|
5.4.1
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.4.1
patch
Dependencies (10)
+ 2 more |
|
5.4.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.4.0
minor
Dependencies (10)
+ 2 more |
|
5.5.0-alpha
pre
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.5.0-alpha
pre
Dependencies (10)
+ 2 more |
|
5.3.1
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.3.1
patch
Dependencies (10)
+ 2 more |
|
5.3.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.3.0
minor
Dependencies (10)
+ 2 more |
|
5.2.11
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.2.11
patch
Dependencies (9)
+ 1 more |
|
5.2.10
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.2.10
patch
Dependencies (9)
+ 1 more |
|
5.2.9
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.2.9
patch
Dependencies (9)
+ 1 more |
|
5.2.8
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.2.8
patch
Dependencies (9)
+ 1 more |
|
5.2.7
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.2.7
patch
Dependencies (9)
+ 1 more |
|
5.2.6
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.2.6
patch
Dependencies (7)
|
|
5.2.5
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.2.5
patch
Dependencies (7)
|
|
5.2.4
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.2.4
patch
Dependencies (7)
|
|
5.2.3
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.2.3
patch
Dependencies (7)
|
|
5.2.2
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.2.2
patch
Dependencies (10)
+ 2 more |
|
5.2.1
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.2.1
patch
Dependencies (10)
+ 2 more |
|
5.2.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.2.0
minor
Dependencies (7)
|
|
5.1.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.1.0
minor
Dependencies (7)
|
|
5.0.0
major
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
5.0.0
major
Dependencies (7)
|
|
4.3.3
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
4.3.3
patch
Dependencies (7)
|
|
4.3.2
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
4.3.2
patch
Dependencies (6)
|
|
4.3.1
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
4.3.1
patch
Dependencies (6)
|
|
4.4.0-alpha
pre
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
4.4.0-alpha
pre
Dependencies (6)
|
|
4.3.0
initial
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
+ 24 more Show less
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |
4.3.0
initial
Dependencies (6)
|