NCalcSync
NCalc is a fast and lightweight expression evaluator library for .NET, designed for flexibility and high performance. It supports a wide range of mathematical and logical operations.
View on Github
Activity
- Latest release
- 1d ago
- Total releases
- 67
- Cadence
- ~5 days
- Last 12 months
- 20
Reach
- Stars
- 1.2k
Details
- License
- MIT
- First release
- Nov 09, 2020
| Version | Released | |
|---|---|---|
7.2.0
minor
| ||
7.1.0
minor
| ||
7.0.2
patch
| ||
7.0.1
patch
| ||
7.0.0
major
| ||
6.4.0
minor
| ||
6.3.3
patch
| ||
6.3.2
patch
| ||
6.3.1
patch
| ||
6.3.0
minor
| ||
6.2.0
minor
| ||
6.1.1
patch
| ||
6.1.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
6.0.0
major
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.13.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.12.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.11.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.10.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.9.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.8.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.7.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.6.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.5.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.4.2
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.4.1
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.4.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.5.0-alpha
pre
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.3.1
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.3.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.2.11
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.2.10
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.2.9
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.2.8
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.2.7
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.2.6
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.2.5
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.2.4
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.2.3
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.2.2
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.2.1
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.2.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.1.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
5.0.0
major
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
4.3.3
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
4.3.2
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
4.3.1
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
4.4.0-alpha
pre
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
4.3.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
4.2.1
patch
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev | ||
4.2.0
minor
1 CVE
CVE-2026-55254
GHSA-3w5p-95mh-gq75
Jun 18, 2026
NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
4.8
/ 10
Medium
Adjacent
High
None
Required
Unchanged
None
None
High
ImpactA denial-of-service (DoS) vulnerability exists in the factorial operator implementation of NCalc. Specially crafted expressions containing extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. Applications that evaluate untrusted expressions using affected versions of NCalc may be vulnerable to resource exhaustion, potentially resulting in service disruption or application unresponsiveness. This issue can be triggered with expressions such as: PatchesThe vulnerability has been fixed by adding bounds validation for factorial operands and rejecting unsupported values before evaluation. Users should upgrade to the first release containing the fix from pull request #575. (v6.1.1+) WorkaroundsIf upgrading is not immediately possible:
These mitigations may reduce exposure but do not fully address the underlying vulnerability. Affected versions
2.0.0
3.0.0
3.1.0
3.10.0
3.11.0
3.12.0
3.13.0
3.13.1
3.2.0
3.3.0
3.4.0
3.5.0
+ 44 more Show less
3.6.0
3.7.0
3.8.0
3.9.0
4.0.0
4.1.0
4.2.0
4.2.1
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0-alpha
5.0.0
5.1.0
5.10.0
5.11.0
5.12.0
5.13.0
5.2.0
5.2.1
5.2.10
5.2.11
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.5.0
5.5.0-alpha
5.6.0
5.7.0
5.8.0
5.9.0
6.0.0
6.1.0
Fixed in
6.1.1
References Updated Jun 18, 2026 · Source: OSV.dev |