CVE-2019-13288-POC

CVE-2019-13288-POC xpdf/install/bin/pdftotext ./poc.pdf Xpdf 4.01.01에서 Parser.cc의 Parser::getObj 함수는 조작된 파일을 통해 무한 재귀를 일으킬 수 있습니다. 원격 공격자는 이를 이용해 DoS 공격을 수행할 수 있습니다. 이는 CVE-2018-16646과 유사합니다...

CVE-2025-46206

MuPDF 1.25.6 및 이전 버전에 서비스 거부 취약점이 있습니다. 공격자가 "mutool clean poc /dev/null" 명령을 실행하면 프로그램이 pdf-clean-file.c의 stripoutlines 및 stripoutline 함수 사이에서 스택이 소진될 때까지 무한 재귀에 빠지게 됩니다. 구체적인 POC 파일, 취약점 원인, 재현 과정 및 수리 제안은 첨부 파일을 참조하십시오. 공급업체MuPDF의 유지관리자인 Artifex Software는 이 문제를 인지하고 버그를 수정했습니다. 수정 사항은 공식 저장소에...

CVE-2025-50420

Poppler 25.07.0 이전 버전에는 pdfseparate 유틸리티의 PDFDoc 처리 로직에 취약점이 존재합니다. 제작된 "/Annots" 사전이 자기 자신 또는 서로를 참조하면 "PDFDoc::markAnnotations -- PDFDoc::markPageObjects -- PDFDoc::markObject -- PDFDoc::markDictionary"에서 무한 재귀가 발생합니다. 루프 감지는 각 fetch에서 사전 포인터 주소가 다르기 때문에 실패합니다. 원격 공격자는 악성 PDF를 처리하여 서비스 거부애플리케이션...

django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...

Astra Linux – Vulnerability in Qemu

A stack overflow due to an infinite recursion vulnerability was detected in the eepro100 i8255x device emulator of QEMU. This issue occurs during the processing of controller commands due to a DMA reentry issue. This flaw allows a guest user or process to consume CPU cycles or cause the QEMU...

Astra Linux - Vulnerability in libxml2

parser.c in libxml2 prior to version 2.9.5 does not prevent infinite recursion in parameter entities...

Astra Linux – Vulnerability in binutils

A vulnerability was discovered in cp-demangle.c within GNU libiberty, as part of the GNU Binutils 2.31 package. This vulnerability stems from infinite recursion in the functions dname, dencoding, and dlocalname in cp-demangle.c. Remote attackers could exploit this vulnerability to cause a...

Astra Linux – Vulnerability in SQLite3

In SQLite, from version 3.30.1 onwards, alter.c allows attackers to trigger infinite recursion through certain types of self-referential views in conjunction with ALTER TABLE statements...

Astra Linux – Vulnerability in poppler, poppler-22

A issue with the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause infinite recursion by providing a crafted PDF file. This can lead to a Denial of Service DoS attack...

Astra Linux – Vulnerability in libxml2

A flaw was discovered in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function, where an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by...

CVE-2026-45271 picotls has infinite recursion in the minicrypto ASN.1 decoder

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c...

CVE-2026-45271

CVE-2026-45271 affects picotls , a TLS protocol library. The minicrypto backend 's ASN.1 validation helper recursively descends into constructed ASN.1 elements without enforcing a maximum nesting depth. An attacker who can supply a crafted private-key file (via ptls_minicrypto_load_private_key())...

CVE-2026-45271 picotls has infinite recursion in the minicrypto ASN.1 decoder

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls implements its own ASN.1 validation helper, which is used by the minicrypto backend while parsing local PKCS8 private keys. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c...

CVE-2026-40345

deepmerge-ts

PT-2026-79091

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 Description The 'move plugin' endpoint in 'cms/admin/placeholderadmin.py' fails to validate the plugin parent value, allowing a staff user with plugin-change permissions to assign a plugin's own identifier or...

CVE-2026-74794

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException...

CVE-2026-74794 Scriban before 6.6.0 Denial of Service via Infinite Recursion

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException...

EUVD-2026-59959

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException...

CVE-2026-74794

Scriban before version 6.6.0 contains an infinite recursion vulnerability in object rendering when ObjectRecursionLimit is unlimited. Attacker-supplied circular references in the template context can exhaust stack space, causing an uncatchable StackOverflowException that terminates the hosting pr...

CVE-2026-74794

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException...