Bug 2540091 (CVE-2026-97058)

Summary: CVE-2026-97058 sprintf-js: sprintf-js: Denial of Service via unbounded precision specifiers
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abarbaro, abrianik, akhatavk, akostadi, alizardo, amasferr, amctagga, anjoseph, anujha, aoconnor, aos-team-art-private, aschwart, asdas, asoldano, aszczucz, ataylor, bbaranow, bbrownin, bmaxwell, bniver, boliveir, bsmejkal, bstansbe, cdrage, csuconic, dbruscin, dfreiber, dlofthou, dmayorov, doconnor, dpaolell, drichtar, drow, dschmidt, ehugonne, flucifre, fmariani, gbenhaim, ggrzybek, gmalinko, gmeno, gotiwari, gparvin, groman, gtully, istudens, ivassile, iweiss, jachapma, janstey, jbalunas, jburrell, jchui, jdelft, jhe, jhorak, jlanda, jlledo, jprabhak, jraez, jsherman, jupierce, jwon, kaycoth, kshier, ktsao, kvanderr, lchilton, lgarciaa, lryznaro, mbenjamin, mbiarnes, mcarlett, mhackett, mosmerov, mposolda, mreynolds, msauton, msvehla, mvyas, nboldt, niyer, nwallace, oaljalju, pantinor, parichar, pberan, pdelbell, pesilva, pjindal, pmackay, ppalepu, ppostler, prdhamdh, progier, psrna, rgemmell, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rmartinc, rstancel, rstepani, rushinde, sdawley, sfeifer, sghai, sidsharm, simaishi, snegrini, sostapov, spichugi, ssilvert, stcannon, sthorger, suppawar, tasato, tbish, tbordaz, tcunning, thjenkin, tlavocat, tsedmik, tsze, twaugh, vashirov, vdosoudi, vereddy, vkumar, vlaad, vmuzikar, watson-tool-maintainers, wtam, yfang, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in sprintf-js. A remote attacker, by controlling format strings, can inject precision values that exceed ECMAScript limits. This lack of validation leads to uncaught RangeError exceptions, allowing the attacker to abort calling operations with a minimal payload, resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-24 14:05:27 UTC 
sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations with minimal payload.