{"id":"CVE-2020-36950","aliases":["EUVD-2020-30865","GHSA-xwgc-2jgm-rr7j"],"status":"published","title":"Laravel Nova 3.7.0 - 'range' DoS","description":"Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00375,"percentile":0.31828,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-770"],"published":"2026-01-27T15:23:50Z","modified":"2026-08-14T16:49:16Z","products":[{"vendor":"laravel holdings inc.","product":"laravel nova"}],"references":[{"url":"https://www.exploit-db.com/exploits/49198","tags":["exploit"]},{"url":"https://nova.laravel.com/","tags":["product"]},{"url":"https://nova.laravel.com/releases","tags":["patch"]},{"url":"https://www.vulncheck.com/advisories/laravel-nova-range-dos","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36950"},{"url":"https://nova.laravel.com"},{"url":"https://github.com/advisories/GHSA-xwgc-2jgm-rr7j"}],"sources":{"cve":[{"id":"CVE-2020-36950","title":"Laravel Nova 3.7.0 - 'range' DoS","description":"Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server.","status":"published","published":"2026-01-27T15:23:50.926Z","modified":"2026-08-14T16:49:16.483Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:35:55.128961Z"}],"euvd":[{"id":"EUVD-2020-30865","description":"Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server.","status":"published","published":"2026-01-27T15:23:50Z","modified":"2026-08-14T16:49:16Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:54.570698Z"}],"ghsa":[{"id":"GHSA-xwgc-2jgm-rr7j","title":"Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to...","description":"Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server.","status":"published","published":"2026-01-27T18:32:14Z","modified":"2026-01-27T18:32:24Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:05:55.903334Z"}],"nvd":[{"id":"CVE-2020-36950","description":"Laravel Nova 3.7.0 contains a denial of service vulnerability that allows authenticated users to crash the application by manipulating the 'range' parameter. Attackers can send simultaneous requests with an extremely high range value to overwhelm and crash the server.","status":"published","published":"2026-01-27T16:16:12.553Z","modified":"2026-06-17T03:16:35.383Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:06:48.591569Z"}]}}