Astra Linux – Vulnerability in libjettison-java

A stack overflow in Jettison prior to v1.5.2 allowed attackers to cause a Denial of Service DoS attack through crafted JSON data...

Astra Linux - Vulnerability in libfastjson

json-c through version 0.14 is vulnerable to an integer overflow and an out-of-bounds write when processing a large JSON file, as demonstrated by printbufmemappend...

Astra Linux – Vulnerability in python-pymysql

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input, because keys are not escaped by escapedict...

Astra Linux – Vulnerability in libjettison-java

Those who use Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS. If the parser runs on user-supplied input, an attacker may provide content that causes the parser to crash due to out-of-memory conditions. This vulnerability could potentially allow for...

Uncontrolled Resource Consumption

github.com/pterodactyl/wings is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded JSON, YAML, and XML configuration file parsers in parser.go processing oversized non-file parser configuration data, which allows an attacker to exhaust the Wings process memory...

BIT-SQLITE-2026-51296

SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information...

EUVD-2026-50327

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

CVE-2026-66920

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...

PT-2026-65610

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.51.0 through 0.60.1 Description Insufficient validation of x-python-type values in the get python type override function within src/datamodel code generator/parser/jsonschema.py allows attacker-controlled JS...

SUSE CVE-2025-12044

Vault and Vault Enterprise “Vault” are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for +HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393...

UBUNTU-CVE-2026-51297

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

PT-2026-64982

Name of the Vulnerable Software and Affected Versions sqlite version 3.41 Description A use-after-free issue exists in the JSON extraction function. The problem occurs when the program continues to access internal members of a freed pointer after the JsonParse object memory has been released via...

CVE-2026-51298

...

sqlite: SQLite: Denial of Service via use-after-free in JSON extraction

A flaw was found in SQLite. A remote attacker could exploit a use-after-free vulnerability in the JSON extraction function. This occurs when the program attempts to access memory after it has been freed, specifically within the JsonParse object. Successful exploitation of this vulnerability can...

Improper Neutralization of Special Elements in Data Query Logic

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the enrichContext process. An attacker can gain unauthorized access to sensitive data, modify or delete arbitrary documents, an...

Improper Handling of Exceptional Conditions

Overview valibot is a The modular and type safe schema library for validating structural data Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions in the flatten process. An attacker can cause the application to throw a TypeError and disrupt normal error...

EUVD-2026-47687

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers...

EUVD-2026-47320

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged...

jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON JavaScript Object Notation data to a service that reads and processes it. This can lead to a Denial of Service Do...

CVE-2026-30623

LiteLLM version 1.18.10 is vulnerable to Remote Code Execution (RCE) due to a lack of validation in its MCP server creation functionality . The application allows users to add MCP servers via JSON configurations containing arbitrary command and args values, which LiteLLM executes directly on the ...