CVE-2026-54268

A flaw was found in the @angular/common package of the Angular framework. A remote attacker could exploit a Denial of Service (DoS) vulnerability in the formatDate function, which is also used by the Angular DatePipe, by providing an excessively long and maliciously crafted date format string. This improper validation of the format parameter's length leads to uncontrolled resource consumption, such as high CPU utilization and excessive memory allocations, ultimately resulting in a Denial of Service for the affected application.

A flaw was found in Angular's @angular/common DatePipe. A crafted date format string can cause excessive CPU consumption, resulting in a denial of service. Red Hat Integration Service Registry includes @angular/common in its UI components and is affected by this vulnerability. Most other Red Hat products matched by SBOM scanning (Firefox, Thunderbird, SpiderMonkey, Ceph, GJS, syncthing, intel-cmt-cat) do not use the Angular framework and are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Validate and sanitize user-supplied date format strings before passing them to Angular's DatePipe. Implement request rate limiting and timeouts on web application endpoints to limit the impact of malicious requests.