CVE-2025-40928 JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact...

CVE-2025-40928 JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact...

CVE-2025-40928

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact...

Security update for protobuf

This update for protobuf fixes the following issues: CVE-2024-2410: Use after free when parsing JSON from a stream bsc1223947. CVE-2024-7254: StackOverflow vulnerability in Protocol Buffers bsc1230778. CVE-2025-4565: Parsing of untrusted Protocol Buffers data containing an arbitrary number of...

Linux Distros Unpatched Vulnerability : CVE-2019-2391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data...

Linux Distros Unpatched Vulnerability : CVE-2024-38517

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the GenericReader::ParseNumber function of include/rapidjson/reader.h whe...

LlamaIndex 安全漏洞

LlamaIndex is a data framework for LLM applications from the LlamaIndex open source. A security vulnerability exists in LlamaIndex version v0.12.37, which stems from an uncontrolled recursion when parsing deeply nested JSON files by the JSONReader component, which could lead to a denial of servic...

PT-2025-34835 · Git · Json2Avro

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=438873397 Crash type: Security exception Crash state: com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializer$Vanilla.deser com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializer$Vanilla.mapOb...

Amazon Linux 2023 : jackson-core (ALAS2023-2025-1127)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1127 advisory. jackson-core contains core low-level incremental streaming parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deepl...

MongoDB 6.0.x < 6.0.21 / 7.0.x < 7.0.17 / 8.0.x < 8.0.5 Improper Validation (SERVER-106749)

The version of MongoDB installed on the remote host is 6.0 prior to 6.0.21, 7.0 prior to 7.0.17 and 8.0 prior to 8.0.5. It is, therefore, affected by a vulnerability as referenced in the SERVER-106749 advisory. - MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism,...

json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)

A flaw was found in the json-smart package. This security flaw occurs when reaching a ‘‘ or ‘‘ character in the JSON input, and the code parses an array or an object, respectively. The 3PP does not have any limit to the nesting of such arrays or objects. Since nested arrays and objects are parsed...

[SECURITY] [DLA 4258-1] libfastjson security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4258-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz July 28, 2025 https://wiki.debian.org/LTS -...

GHSA-J87P-GJR6-M4PV Duplicate Advisory: serde-json-wasm stack overflow during recursive JSON parsing

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rr69-rxr6-8qwf. This link is maintained to preserve external references. Original Description The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data...

Duplicate Advisory: serde-json-wasm stack overflow during recursive JSON parsing

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rr69-rxr6-8qwf. This link is maintained to preserve external references. Original Description The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data...

java-sec-code

This is an offensive tool for Java web applications. It is a collection of Java web common vulnerabilities and security code, based on Spring Boot and Spring Security. The repository contains various types of vulnerabilities, including actuators to RCE, command inject, CORS, CRLF injection, CSRF,...

USN-7657-2 jq vulnerabilities

USN-7657-1 fixed CVE-2024-23337 and CVE-2025-48060 in jq. This update provides the corresponding fixes for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS. Original advisory details: It was discovered that jq incorrectly handled certain values when parsing JSON data. A remote attacker...

Ubuntu 22.04 LTS / 24.04 LTS / 25.04 : jq vulnerabilities (USN-7657-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7657-1 advisory. It was discovered that jq incorrectly handled certain values when parsing JSON data. A remote attacker could possibly use this issue ...

USN-7657-1: jq vulnerabilities

It was discovered that jq incorrectly handled certain values when parsing JSON data. A remote attacker could possibly use this issue to cause jq to crash, resulting in a denial of service. CVE-2024-23337 It was discovered that jq incorrectly handled NaN values when parsing JSON data. A remote...

Amazon Linux 2023 : jackson-core (ALAS2023-2025-1063)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1063 advisory. Jackson-core contains core low-level incremental streaming parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in...

GHSA-3WXX-Q3GV-PVVV LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsing

The JSONReader in run-llama/llamaindex versions 0.12.28 is vulnerable to a stack overflow due to uncontrolled recursive JSON parsing. This vulnerability allows attackers to trigger a Denial of Service DoS by submitting deeply nested JSON structures, leading to a RecursionError and crashing...