plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length
Priority LOW 30CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, and plone.app.contenttypes versions through 3.0.11, 4.0.0 through 4.0.9, and 5.0.0 are vulnerable to denial of service because an authenticated user can create content with excessively long titles, descriptions, or uploaded-file names, causing Plone to become unresponsive and potentially making the resulting content difficult to edit or delete. The vulnerability is patched in plone.app.dexterity versions 3.2.3, 4.1.3, and 5.0.1, and in plone.app.contenttypes versions 3.0.12, 4.0.10, and 5.0.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00762 55th percentileScored 2026-11-07
Fix Fixed plone.app.dexterity (plone): 4.1.3, 3.2.3plone.app.contenttypes (plone): 4.0.10, 3.0.12+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| plone | plone.app.dexterity | = 5.0.0; 4.0.0 to before 4.1.3; before 3.2.3 | 4.1.3, 3.2.3 | Patch available | CNA |
| plone | plone.app.contenttypes | = 5.0.0; 4.0.0 to before 4.0.10; before 3.0.12 | 4.0.10, 3.0.12 | Patch available | CNA |
| — | plone.app.dexterity (PyPI) | 5.0.0 to before 5.0.1 | 5.0.1 | Patch available | GHSA-5426-92w4-wvhv |
| — | plone.app.dexterity (PyPI) | 4.0.0 to before 4.1.3 | 4.1.3 | Patch available | GHSA-5426-92w4-wvhv |
| — | plone.app.dexterity (PyPI) | before 3.2.3 | 3.2.3 | Patch available | GHSA-5426-92w4-wvhv |
- plone.app.dexterity Vendorplone Affected = 5.0.0; 4.0.0 to before 4.1.3; before 3.2.3 Fixed in 4.1.3, 3.2.3 Patch available CNA
- plone.app.contenttypes Vendorplone Affected = 5.0.0; 4.0.0 to before 4.0.10; before 3.0.12 Fixed in 4.0.10, 3.0.12 Patch available CNA
- plone.app.dexterity (PyPI) Vendor— Affected 5.0.0 to before 5.0.1 Fixed in 5.0.1 Patch available GHSA-5426-92w4-wvhv
- plone.app.dexterity (PyPI) Vendor— Affected 4.0.0 to before 4.1.3 Fixed in 4.1.3 Patch available GHSA-5426-92w4-wvhv
- plone.app.dexterity (PyPI) Vendor— Affected before 3.2.3 Fixed in 3.2.3 Patch available GHSA-5426-92w4-wvhv
Remediation
- Fix · CNA plone.app.dexterity (plone) Fixed in 4.1.3, 3.2.3
- Fix · CNA plone.app.contenttypes (plone) Fixed in 4.0.10, 3.0.12
- Fix · GHSA-5426-92w4-wvhv plone.app.dexterity (PyPI) Fixed in 5.0.1 Advisory →
- Fix · GHSA-5426-92w4-wvhv plone.app.dexterity (PyPI) Fixed in 4.1.3 Advisory →
- Fix · GHSA-5426-92w4-wvhv plone.app.dexterity (PyPI) Fixed in 3.2.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-57576
- 2026-10-03 Alias added: GHSA-5426-92w4-wvhv
References
Other 18
- https://github.com/plone/plone.app.dexterity/security/advisories/GHSA-5426-92w4-wvhv
- https://github.com/plone/plone.app.contenttypes/security/advisories/GHSA-8pcw-h6w9-h46g
- https://github.com/plone/plone.app.contenttypes/commit/13dc98a578341aac24a1e65fd9bc7ac8a07d168a
- https://github.com/plone/plone.app.contenttypes/commit/21bae6ebe424689eeac9a5884fc0da35f4944e63
- https://github.com/plone/plone.app.contenttypes/commit/639c0619f371df578e69ec94e5ca98e60fd6ed58
- https://github.com/plone/plone.app.contenttypes/commit/7bb03e8ec6c6bd0e645f445b0755e85a51afb158
- https://github.com/plone/plone.app.contenttypes/commit/bed1547d4f8b1fc995f2c76f30ba5f20276a8ad6
- https://github.com/plone/plone.app.dexterity/commit/0d317df663823445200d0569a66a95b7e4a9c50d
- https://github.com/plone/plone.app.dexterity/commit/2fdceb120ca86682a408f3a14753cfcf5126d9d9
- https://github.com/plone/plone.app.dexterity/commit/411689047f9a3521899ae6992a9b0efbd0592a8f
- https://github.com/plone/plone.app.dexterity/commit/cbcef731c0882146b9bf30688cdc639d879878fb
- https://github.com/plone/plone.app.dexterity/commit/f3596538cf7670bb8bc27b0dfa0b1da41c8b8a3a
- https://github.com/plone/plone.app.dexterity/commit/fb45bfdb18f1dfb3ed55e477947a3df9a6ee9e20
- https://github.com/plone/plone.app.dexterity/pull/433
- https://github.com/plone/plone.app.dexterity
- https://github.com/plone/plone.app.dexterity/releases/tag/3.2.3
- https://github.com/plone/plone.app.dexterity/releases/tag/4.1.3
- https://github.com/plone/plone.app.dexterity/releases/tag/5.0.1
More plone vulnerabilities
- TI-2024-15205 An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could… CVSS 3.1CRITICAL 9.8
- TI-2011-03162 Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through… CVSS 2.0HIGH 9.3
- TI-2021-13226 An issue in Plone CMS v. CVSS 3.1HIGH 8.8
- TI-2024-15757 The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13… CVSS 3.1HIGH 7.5
- TI-2024-15206 An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for… CVSS 3.1MEDIUM 6.1
- TI-2008-01340 Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the… CVSS 2.0HIGH 10.0
Sources
- CVE-2026-57576 · CVE Program
- CVE-2026-57576 · NVD
- FIRST EPSS
- GHSA-5426-92w4-wvhv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences