CVE-2026-74789 exposes a dangerous gap in Scriban's LoopLimit feature that renders it inadequate as a DoS defense while simultaneously creating the illusion of protection. LoopLimit was designed to cap iteration in templates, but several primitives — most notably array.size and string multiplication ('A' * 200000000) — perform unbounded work without triggering the limit. This isn't a missing check in isolation; it's a structural failure where the existence of a named, configurable constraint led developers to believe their template rendering pipeline was secured when it was not.
Test your exposure by examining any template that accepts user input or processes external data. Check whether your code calls array.size on untrusted collections, uses string repetition or concatenation in loops, or relies on any logic that measures collection size to bound iteration. If LoopLimit is your only compensating control, you have a gap. The bypass paths allocate memory proportional to input size without entering an explicit loop, so a template like {{ (range 1 1000000) | array.size }} or {{ 'x' * 200000000 }} will consume gigabytes of memory while LoopLimit remains at its configured value.
The remediation path has two layers. First, apply any available patch that extends LoopLimit enforcement to these primitives. Second, assume LoopLimit provides incomplete coverage until proven otherwise — audit your template validation logic, add input size limits at the parsing layer before templates reach the interpreter, and treat any template rendering from untrusted sources as a high-risk operation requiring defense-in-depth. The pattern here is well-documented across templating engines: named security constraints create mental models that their implementation cannot sustain. Don't let LoopLimit be the reason you stop looking for other protections.