{"id":"CVE-2020-36950","state":"PUBLISHED","title":"Laravel Nova 3.7.0 - 'range' DoS","description":"Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server.","publishedAt":"2026-01-27T15:23:50.926Z","updatedAt":"2026-08-14T16:49:16.483Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Laravel Holdings Inc. Laravel Nova"],"affected":[{"vendor":"Laravel Holdings Inc.","product":"Laravel Nova","versions":[{"version":"3.7.0","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/49198","https://nova.laravel.com/","https://nova.laravel.com/releases","https://www.vulncheck.com/advisories/laravel-nova-range-dos"],"weaknesses":["CWE-770"],"ingestedAt":"2026-10-29T19:47:24.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/36xxx/CVE-2020-36950.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2020-36950","state":"PUBLISHED","datePublished":"2026-01-27T15:23:50.926Z","dateUpdated":"2026-08-14T16:49:16.483Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-01-25T13:50:01.143Z"},"containers":{"cna":{"title":"Laravel Nova 3.7.0 - 'range' DoS","descriptions":[{"lang":"en","value":"Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server."}],"affected":[{"vendor":"Laravel Holdings Inc.","product":"Laravel Nova","versions":[{"version":"3.7.0","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/49198","name":"ExploitDB-49198","tags":["exploit"]},{"url":"https://nova.laravel.com/","name":"Laravel Nova Official Homepage","tags":["product"]},{"url":"https://nova.laravel.com/releases","name":"Laravel Nova Releases Page","tags":["patch"]},{"url":"https://www.vulncheck.com/advisories/laravel-nova-range-dos","name":"VulnCheck Advisory: Laravel Nova 3.7.0 - 'range' DoS","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","lang":"en","description":"Allocation of Resources Without Limits or Throttling","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-08-14T16:49:16.483Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:laravel:laravel:3.7.0:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"iqzer0","type":"finder"}],"x_generator":{"engine":"vulncheck"},"datePublic":"2020-12-04T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-27T21:07:25.905338Z","id":"CVE-2020-36950","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-27T21:35:57.367Z"}}]}}}