CVE-2026-54268
Description
A flaw was found in the @angular/common package of the Angular framework. A remote attacker could exploit a Denial of Service (DoS) vulnerability in the formatDate function, which is also used by the Angular DatePipe, by providing an excessively long and maliciously crafted date format string. This improper validation of the format parameter's length leads to uncontrolled resource consumption, such as high CPU utilization and excessive memory allocations, ultimately resulting in a Denial of Service for the affected application.
Statement
A flaw was found in Angular's @angular/common DatePipe. A crafted date format string can cause excessive CPU consumption, resulting in a denial of service. Red Hat Integration Service Registry includes @angular/common in its UI components and is affected by this vulnerability. Most other Red Hat products matched by SBOM scanning (Firefox, Thunderbird, SpiderMonkey, Ceph, GJS, syncthing, intel-cmt-cat) do not use the Angular framework and are not affected.
Mitigation
Validate and sanitize user-supplied date format strings before passing them to Angular's DatePipe. Implement request rate limiting and timeouts on web application endpoints to limit the impact of malicious requests.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | 7.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | Low | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat CVSS v3 Score Explanation
A:H->L: DoS is per-request, mitigated by systemd auto-restart and reverse proxy rate limiting in typical RH deployments. Impact is transient.
Understanding the Weakness (CWE)
Other,Integrity,Availability
Technical Impact: Varies by Context; DoS: Resource Consumption (CPU); Modify Memory; Read Memory
When the quantity is not properly validated, then attackers can specify malicious quantities to cause excessive resource allocation, trigger unexpected failures, enable buffer overflows, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
