FreeBSD : Erlang/OTP -- TLS denial of service using invalid certificate chains (445d3f14-89e1-11f1-b35c-4c526214c986)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 445d3f14-89e1-11f1-b35c-4c526214c986 advisory. https://github.com/erlang/otp/security/advisories/GHSA-r5jr-mq46-vmhw reports: A TLS/DTLS peer can cras...

CVE-2026-66920: Uncontrolled Recursion

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...

CVE-2026-16192: Uncontrolled Recursion

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled...

PT-2026-65483

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...

Elasticsearch 8.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-64 / ESA-2026-68 / ESA-2026-74)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.19, or 9.0.x prior to 9.3.8, or 9.4.x prior to 9.4.4. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-64, ESA-2026-68, and ESA-2026-74 advisories. - Reachable Assertion CWE-617 in...

CVE-2026-58227

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

AZL-94205 CVE-2026-58227 affecting package erlang for versions less than 26.2.5.21-4

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

CVE-2026-58227

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

EEF-CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

Summary The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl\certificate:handle\incomplete\chain/5, the received chain is passed to ssl\certificate:build\certificate\chain/5, which walks issuer...

CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

CVE-2026-17501

A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull...

CVE-2026-17501

A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull...

CVE-2026-17501: Uncontrolled Recursion

A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull...

CVE-2026-58227: Uncontrolled Recursion

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

Erlang/OTP -- TLS denial of service using invalid certificate chains

https://github.com/erlang/otp/security/advisories/GHSA-r5jr-mq46-vmhw reports: A TLS/DTLS peer can crash the remote node by sending a certificate chain containing two mutually cross-signed certificates in unordered form. When the receiving side attempts to build a valid chain path, it enters...

Fedora 43 : p11-kit (2026-566791181a)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-566791181a advisory. - server: fixed stack exhaustion via unbounded recursion in RPC attribute parsing by enforcing a recursion depth limit CVE-2026-13757 - fixed confusing error...

GO-2026-5684 Go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth in github.com/ipld/go-ipld-prime

Go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth in github.com/ipld/go-ipld-prime...

node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

Summary node-tar npm tar contains an uncontrolled-recursion stack-exhaustion DoS in the internal mapHas helper used by filesFilter. When a consumer calls tar.t... or tar.x... with a non-empty member-selection list, node-tar installs a filter that closes over the recursive mapHas src/list.ts:33-44...

Uncontrolled Recursion

Overview tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Uncontrolled Recursion in the mapHas helper and filesFilter function in src/list.ts, which walk an entry path upward with one path.dirname call per recursion and no segment cap. An attacker can...