CVE-2026-95155

A flaw was found in jackson-mapper-asl. This vulnerability allows a remote attacker to cause a Denial of Service DoS by submitting deeply nested JSON input to an application that deserializes untrusted data using the ObjectMapper component. Processing the excessively nested structure exhausts...

Detection-and-Mitigation-script-for-CVE-2021-42717

Detection-and-Mitigation-script-for-CVE-2021-42717 Detection and Mitigation script for CVE-2021-42717 - ModSecurity DoS Vulnerability in JSON Parsing ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in...

day01-sessionreaper-lab

Day 1 — SessionReaper-style Vulnerable Lab Educational This is a tiny lab that simulates the core idea reported for CVE-2025-54236 “SessionReaper”: improper validation of nested JSON leading to dangerous code paths. This is not Magento/Adobe Commerce; it's a minimal educational replica to practic...

CVE-2026-116011 Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()

Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating...

CVE-2026-116011 Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()

Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating...

CVE-2026-116011

Crow versions prior to 1.3.4 are susceptible to a Denial of Service (DoS) vulnerability due to uncontrolled recursion in the crow::json::load() function. Remote unauthenticated attackers can crash the server by submitting a request body containing thousands of deeply nested JSON objects . This ac...

CVE-2026-116011 Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()

Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating...

EUVD-2026-109269

Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating...

PT-2026-122592

Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating...

EUVD-2026-107412

stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving Odepth^2 CPU denial of service...

CVE-2026-110974 Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue calls readArray and readObject, which call nextValue again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes t...

CVE-2026-95155

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...

CVE-2026-95155

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...

CVE-2026-95155

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...

PT-2026-114977

Name of the Vulnerable Software and Affected Versions jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13 Description An issue exists where attackers can cause a denial of service by providing deeply nested JSON input to an application that deserializes untrusted JSON using the...

EUVD-2026-102127

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...

CVE-2026-95155

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...

CVE-2026-95155

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...

CVE-2026-104635

Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3,...

UBUNTU-CVE-2026-104635

Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3,...