566 matches found
CVE-2017-12635
CVE-2017-12635 Case study and PoC of CVE-2017-12635 Apache CouchDB 1.7.0 / 2.x 2.1.1 - Remote Privilege Escalation Presentation CouchDB Apache CouchDB is a document-oriented NoSQL database, implemented in Erlang. CouchDB uses multiple formats and protocols to store, transfer, and process it's dat...
CLEANSTART-2026-FG35572 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)
Security vulnerability affects the spark-sc213-jdk17-py312 package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...
CVE-2026-112072
A flaw was found in vault-java-driver. The driver's internal JSON parser does not enforce a limit on nesting depth when processing server responses. An authenticated user with write permissions to a Vault path can store deeply nested data, which triggers a stack overflow during parsing and...
CVE-2026-112072
vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch Exception handlers and kills the reading thread. A Vault token that can...
EUVD-2026-117399
vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch Exception handlers and kills the reading thread. A Vault token that can...
CVE-2026-112072 vault-java-driver: stored deeply nested JSON kills every thread that reads it
vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch Exception handlers and kills the reading thread. A Vault token that can...
CVE-2026-112072 vault-java-driver: stored deeply nested JSON kills every thread that reads it
vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch Exception handlers and kills the reading thread. A Vault token that can...
CVE-2026-112072
The vault-java-driver (a Java client for HashiCorp Vault) is vulnerable to a StackOverflowError due to an uncontrolled recursion issue in its vendored minimal-json parser . The parser lacks a nesting depth limit, allowing deeply nested JSON values to crash the reading thread. This impact is persi...
CVE-2026-106121
A flaw was found in the RabbitMQ Java client library. When parsing incoming JSON-formatted messages, the built-in parser fails to terminate correctly if an input ends abruptly within an unclosed string or comment. A remote attacker could send a specially crafted, truncated message to trigger an...
CLEANSTART-2026-IC65897 flatted is a circular JSON parser
Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...
CLEANSTART-2026-KQ76880 flatted is a circular JSON parser
Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...
CLEANSTART-2026-QZ59446 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)
CVE-2026-18401 affects multiple packages. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. See references for individual vulnerability details...
CLEANSTART-2026-DK54299 flatted is a circular JSON parser
Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...
CLEANSTART-2026-CE66026 flatted is a circular JSON parser
Security vulnerability affects the argo-workflows package. flatted is a circular JSON parser...
com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...
com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...
com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...
EUVD-2026-110481
flatcc through 0.6.4 contains an out-of-bounds read vulnerability in flatccjsonparsernumber that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing...
CVE-2026-116733
flatcc through 0.6.4 contains an out-of-bounds read vulnerability in flatccjsonparsernumber that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing...
CVE-2026-116733
The flatcc library, versions through 0.6.4 , is vulnerable to an out-of-bounds read in the flatcc_json_parser_number function. Attackers can trigger this by providing untrusted JSON containing numbers that end with a decimal point. This allows the parser to read past the input buffer, potentiall...