237 matches found
SUSE CVE-2026-93435
redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust t...
GHSA-2VH9-CV26-P97M Duplicate Advisory: vm2: util.getCallSites() bypasses GHSA-v27g host-frame redaction, leaks host call stack
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r273-hxvj-fxhp. This link is maintained to preserve external references. Original Description vm2 is a sandbox for running untrusted Node.js code. In versions = 22.9 this hands sandboxed code util.getCallSites, ...
Duplicate Advisory: vm2: util.getCallSites() bypasses GHSA-v27g host-frame redaction, leaks host call stack
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r273-hxvj-fxhp. This link is maintained to preserve external references. Original Description vm2 is a sandbox for running untrusted Node.js code. In versions = 22.9 this hands sandboxed code util.getCallSites, ...
CVE-2026-92933
A flaw was found in vm2. The NodeVM component exposes the host util module, including the util.getCallSites function, to the sandbox as an unfiltered copy. On Node.js versions 22.9 and later, this allows sandboxed code to access util.getCallSites, which can return the host process's full call...
CVE-2026-92933 vm2 before 3.11.8 Information Disclosure via util.getCallSites
vm2 is a sandbox for running untrusted Node.js code. In versions = 22.9 this hands sandboxed code util.getCallSites, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and...
CVE-2026-92933 vm2 before 3.11.8 Information Disclosure via util.getCallSites
vm2 is a sandbox for running untrusted Node.js code. In versions = 22.9 this hands sandboxed code util.getCallSites, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and...
CVE-2026-92933
vm2 (a Node.js sandbox for untrusted code) in versions ≤ 3.11.7 leaks host-process information to sandboxed code. The root cause is that NodeVM exposes the host util module as an unfiltered shallow copy via defaultBuiltinLoaderUtil, and the deprecated sys builtin (an alias of util) through the ge...
CVE-2026-93435: Uncontrolled Recursion
redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust t...
PT-2026-95163
Name of the Vulnerable Software and Affected Versions redis-parser versions prior to 3.0.1 Description A denial of service issue exists in the RESP Redis Serialization Protocol parser. Malicious Redis endpoints can crash the client process by sending crafted RESP byte streams containing repeated...
Uncontrolled Recursion
Overview github.com/google/go-attestation/attest is a Go-Attestation abstracts remote attestation operations across a variety of platforms and TPMs, enabling remote validation of machine identity and state. This project attempts to provide high-level primitives for both client and server logic...
CVE-2026-77465 toml-node: Uncontrolled Recursion
toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinlinetableentry functions recurse through nested arrays and inline tables without a depth...
CVE-2026-84851
An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...
CVE-2026-84851: Uncontrolled Recursion
An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...
CVE-2026-77465: Uncontrolled Recursion
toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinlinetableentry functions recurse through nested arrays and inline tables without a depth...
EUVD-2026-70281
An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...
CVE-2026-84851
CVE-2026-84851 is an uncontrolled recursion vulnerability in the Ion reader component of Amazon Ion-C , affecting versions before 1.1.6 . A remote, unauthenticated attacker can craft malicious Ion data that exhausts the native call stack, causing a denial of service in any application using the l...
CVE-2026-84851 Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6
An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...
Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in axios
Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in axios. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-67312 DESCRIPTION: axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain...
PT-2026-84881
An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...
EUVD-2026-63468
deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...