CVE-2026-115274

A flaw was found in Elixir. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by exhausting system resources. The standard library's JSON parsing module fails to restrict the length of integer numbers during data decoding. By submitting a specially...

CVE-2026-116011

A flaw was found in Crow. An issue during JSON parsing allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending specially crafted, deeply nested JSON requests. Processing these excessively nested structures causes thread stack exhaustion through unbounded recursive...

CVE-2026-0915-json-Patch.-V2.0

CVE-2026-0915-json-Patch.-V2.0 Patch the Bug - glibc 🔒 JSON Validator Security Patch Enterprise-grade solution for CVE-2026-0915 - Protects against insecure JSON parsing through strict schema validation. 🚨 Security Notice This patch fixes CVE-2026-0915 - a critical vulnerability in JSON parsing...

json_cve_2020_10663

Workaround for CVE-2020-10663 vulnerability in json gem The json gem has a security vulnerability CVE-2020-10663. When parsing certain JSON documents, the json gem can be coerced into creating arbitrary objects in the target system. Users are strongly advised to upgrade to json 2.3.0 or later. Fo...

Detection-and-Mitigation-script-for-CVE-2021-42717

Detection-and-Mitigation-script-for-CVE-2021-42717 Detection and Mitigation script for CVE-2021-42717 - ModSecurity DoS Vulnerability in JSON Parsing ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in...

CVE-2026-54350-Budibase-NoSQL-Injection

CVE-2026-54350 — Budibase Unauthenticated NoSQL Operator Injection Unauthenticated JSON/NoSQL operator injection in Budibase. Any anonymous visitor of a published Budibase app that exposes a PUBLIC query backed by a document datasource MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST wi...

CVE-2022-33171

CVE-2022-33171: TypeORM SQL Injection Note: This is a work-in-progress analysis of CVE-2022-33171. The details provided here may be updated as further information becomes available.currently not working Vulnerability Details CVE ID: CVE-2022-33171 Product: TypeORM Affected Versions: 0.3.0...

Apache-couchdb-CVE-2017-12635

CouchDB Vertical Privilege Escalation Vulnerability CVE-2017-12635 Apache CouchDB is an open-source database that focuses on ease of use and being a "fully web-embracing database." It is a NoSQL database that uses JSON as the storage format, JavaScript as the query language, and MapReduce and HTT...

couchdb-exploit

🚀 CouchDB Exploit - CVE-2017-12635 & CVE-2017-12636 Apache CouchDB - Privilege Escalation & Remote Code Execution 📖 Overview This tool exploits two critical vulnerabilities in Apache CouchDB: CVE| Description| Severity ---|---|--- CVE-2017-12635| Privilege Escalation via JSON Parsing Bypass| 🔴...

crack-0.1.8-fixed

= crack Really simple JSON and XML parsing, ripped from Merb and Rails. The XML parser is ripped from Merb and the JSON parser is ripped from Rails. I take no credit, just packaged them for all to enjoy and easily use. == note on releases Releases are tagged on github and also released as gems on...

CVE-2025-6710

MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack space consumption. Such inputs can lead to a stack overflow that causes the server to crash which coul...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146971)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146971 advisory. An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation...

Go JOSE: Panics in JSON parsing

Summary Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash. Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Impact Denial of service vulnerability. Any application that parses untrusted JS...

EUVD-2026-110466

Go JOSE: Panics in JSON parsing...

GHSA-VVM8-GF78-28G4 Go JOSE: Panics in JSON parsing

Summary Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash. Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Impact Denial of service vulnerability. Any application that parses untrusted JS...

Linux Distros Unpatched Vulnerability : CVE-2026-116586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON W...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the JSON parsing process. An attacker can cause the application to crash by submitting deeply nested arrays or objects, leading to stack exhaustion. Remediation Upgrade github.com/go-jose/go-jose/v4/json t...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the JSON parsing process. An attacker can cause the application to crash by submitting deeply nested arrays or objects, leading to stack exhaustion. Remediation There is no fixed version for...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the JSON parsing process. An attacker can cause the application to crash by submitting deeply nested arrays or objects, leading to stack exhaustion. Remediation There is no fixed version for...

AZL-112049 CVE-2026-116586 affecting package libcontainers-common 20240213-3

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...