CVE-2026-103008 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds...

EUVD-2026-93938

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds...

CVE-2026-103008 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds...

CVE-2026-103008 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds...

CVE-2026-103008

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds...

Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-198)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth...

CVE-2026-103008: Uncontrolled Recursion

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds...

PT-2026-107167

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An uncontrolled recursion weakness exists in how the server builds and serializes geometry values produced by scripted runtime fields. While geometry supplied as text has a nesting-dept...

Elasticsearch 9.0.x < 9.4.8 / 9.5.x < 9.5.5 DoS (ESA-2026-198)

The version of Elasticsearch installed on the remote host is 9.0.x prior to 9.4.8, or 9.5.x prior to 9.5.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-198 advisory. - Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially...

Astra Linux – Vulnerability in CGal

There are multiple code execution vulnerabilities in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could result in code execution. An attacker can provide malicious input to trigger...

Astra Linux – Vulnerability in CGal

There are multiple code execution vulnerabilities in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could result in code execution. An attacker can provide malicious input to trigger...

Astra Linux – Vulnerability in CGal

There are multiple code execution vulnerabilities in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted, malformed file can lead to an out-of-bounds read and type confusion, which may result in code execution. An attacker can provide malicious input to trigger a...

Astra Linux – Vulnerability in CGal

There is a code execution vulnerability in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. There is also an oob read vulnerability in NefS2/SNCioparser.h, specifically in the function SNCioParser::readsloop and slh-twin. An attacker can provide malicious input to trigger this...

PYSEC-2026-4139 psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

Summary PSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...

AlmaLinux 9.6 [TuxCare] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc (ALMALINUX9.6:CLSA-2026:1779497454)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779497454 advisory. - A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the...

Rocky Linux 9.6 [TuxCare] Security Update: xorg-x11-server-Xwayland / xorg-x11-server-Xwayland-devel (ALMALINUX9.6:CLSA-2026:1790330410)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790330410 advisory. - A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the...

AlmaLinux 9.6 [TuxCare] Security Update: xorg-x11-server-Xwayland / xorg-x11-server-Xwayland-devel (ALMALINUX9.6:CLSA-2026:1790330410)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790330410 advisory. - A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the...

CVE-2026-88368

The NanoSVG library (commit 239e102ec) contains an incorrect numeric conversion vulnerability within the rasterizer's nsvg__addActive() function. A specially crafted SVG document with large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the representable range of an ...

GHSA-8Q6G-VJHF-JP8M psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry

Summary PSDImage.composite and .numpy allocate the output image buffer from the PSD's header geometry width × height × channels × depth, and per-layer rectangles before validating those values against the actual file contents. A tiny crafted PSD declaring huge dimensions causes a multi-gigabyte...

SUSE CVE-2026-93653

A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline...