SUSE CVE-2026-63981

In the Linux kernel, the following vulnerability has been resolved: net/sched: actmirred: Fix blockcast recursion bypass leading to stack overflow tcfmirredact checks schedmirrednest against MIRREDNESTLIMIT 4 to prevent deep recursion. However, when the action uses blockcast tcfmblockid != 0, the...

PT-2026-62047

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2739)

According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function...

EulerOS Virtualization 2.12.0 : libxml2 (EulerOS-SA-2026-2785)

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function...

CVE-2026-63144: Uncontrolled Recursion

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch que...

PT-2026-63262

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Uncontrolled Recursion in the query evaluation component allows a low-privileged authenticated user with read-level index access to cause a denial of service. By submitting a specially...

Oracle Linux 10 : kernel (ELSA-2026-18134)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-18134 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

Uncontrolled Recursion

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Uncontrolled Recursion in the defaultVisitor function of lib/helpers/toFormData.js, which calls JSON.stringify on a value when its top-level key ends in , before the...

Uncontrolled Recursion

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Uncontrolled Recursion in the defaultVisitor function of lib/helpers/toFormData.js, which calls JSON.stringify on a value when its top-level key ends in ,...

GHSA-8MPJ-M6QM-5QR8 Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

Summary Type: Uncontrolled recursion via mutual include. The Include directive checks for direct self-reference a.md cannot include a.md, but does not detect indirect cycles. Two markdown files that include each other a.md → includes b.md → includes a.md cause unbounded recursion until Python's...

Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

Summary Type: Uncontrolled recursion via mutual include. The Include directive checks for direct self-reference a.md cannot include a.md, but does not detect indirect cycles. Two markdown files that include each other a.md → includes b.md → includes a.md cause unbounded recursion until Python's...

EUVD-2026-42339

Mistune directives/include: mutual .. include:: recursion crashes the renderer with RecursionError, denial of service via two attacker-controlled markdown files...

NPM: Axios: Excessive recursion in formDataToJSON can cause denial of service

NPM: Axios: Excessive recursion in formDataToJSON can cause denial of service vulnerability discovered by ? in WordPress Npm axios versions = 0.28.0, 0.33.0...

Uncontrolled Recursion

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Uncontrolled Recursion in the buildPath function of lib/helpers/formDataToJSON.js, which recurses once per FormData key path segment without enforcing a...

GHSA-42H9-826W-CGV3 Axios: Excessive recursion in formDataToJSON can cause denial of service

Summary Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON, the helper behind the public axios.formToJSON / named formToJSON API and the default request transform used when FormData is sent with an application/json content type. Applications are affected when they pa...

CVE-2026-64194

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack at least with...

CVE-2026-64194 Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack at least with...

NPM: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

NPM: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service vulnerability discovered by ? in WordPress Npm axios versions = 0.28.0, 0.33.0...

Duplicate Advisory: SurrealDB has Denial of Service in JSON parser due to nested objects

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q729-696q-g9pq. This link is maintained to preserve external references. Original Description SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when...

GHSA-M464-HJ36-96VX Duplicate Advisory: SurrealDB has Denial of Service in JSON parser due to nested objects

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q729-696q-g9pq. This link is maintained to preserve external references. Original Description SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when...