CVE-2026-55254

Name of the Vulnerable Software and Affected Versions NCalc versions prior to 6.1.1

Description The factorial operator implementation in src/NCalc.Core/Helpers/MathHelper.cs allows specially crafted expressions with extremely large factorial operands to cause excessive CPU consumption or a non-terminating loop. This occurs due to integer overflow in the factorial calculation logic when the application evaluates untrusted expressions, potentially leading to resource exhaustion and service disruption.

Recommendations Update to version 6.1.1 or later. Do not evaluate expressions originating from untrusted users. Validate or sanitize expressions before evaluation and reject factorial operations on large values. Implement execution time limits, request timeouts, or cancellation mechanisms around expression evaluation.