Scriban contains three distinct denial‑of‑service flaws in its expression evaluator. The bugs allow unbounded string multiplication, uncontrolled BigInteger shift operations, and a loop‑limit bypass via range enumeration in builtin functions. The result is out‑of‑memory exceptions or sustained CPU exhaustion that can terminate the entire host process. The weakness is a classic untrusted input resource exhaustion flaw (CWE‑400).

The affected component is the Scriban template engine distributed under the scriban:scriban vendor. All releases prior to 7.0.0 are vulnerable, regardless of minor version offsets. No later version of Scriban mitigates these issues.

The CVSS score of 7.1 indicates a high severity. Because the exploit requires the attacker to supply arbitrary template code, it is typically relevant only when template input is under attacker control. No EPSS value is available, and the vulnerability is not in the CISA KEV catalog, so the current risk profile is high but the exploitation likelihood is unclear without an EPSS estimate. The attack chain therefore depends on administrative access to the templating logic or on design weaknesses that expose template evaluation to untrusted data.