Description
Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Published: 2026-08-28
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An input validation weakness in Pega Platform allows crafted data to be used as a loop condition, potentially causing the application to execute an excessive or infinite loop that consumes CPU and memory until the service becomes unresponsive. This flaw can lead to a denial of service and may also degrade overall system performance.

Affected Systems

Pegasystems Pega Infinity and all Pega Platform releases from version 7.1.0 through 25.1.2 are affected. No specific patch or service pack is identified in the advisory.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is not available, so the likelihood of exploitation is unknown. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could supply malicious input via exposed user interfaces, API endpoints, or configuration files that influence loop conditions. If successful, the application would experience resource exhaustion and a denial of service.

Generated by OpenCVE AI on August 28, 2026 at 17:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain the latest Pega Platform release notes and apply any available updates that address input validation for loop conditions.
  • Implement application‑level validation to restrict the size, range, and format of any input that can become a loop condition, ensuring values remain within safe limits.
  • Configure monitoring of CPU and memory usage to detect spikes indicative of excessive looping, and set alerts to notify staff or trigger automated isolation or service restart.
  • Disable or restrict access to interfaces or configuration paths that accept unrestricted user input for loop conditions if the functionality is not required.

Generated by OpenCVE AI on August 28, 2026 at 17:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Pegasystems
Pegasystems pega Infinity
Vendors & Products Pegasystems
Pegasystems pega Infinity

Fri, 28 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Description Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Title Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Weaknesses CWE-606
References
Metrics cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:L'}

Subscriptions

Pegasystems Pega Infinity
cve-icon MITRE

Status: PUBLISHED

Assigner: Pega

Published:

Updated: 2026-08-28T13:11:34.206Z

Reserved: 2026-06-29T18:24:41.533Z

Link: CVE-2026-13761

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T16:17:06.870

Modified: 2026-08-28T16:17:06.870

Link: CVE-2026-13761

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T17:15:04Z

Weaknesses
  • CWE-606

    Unchecked Input for Loop Condition