CVE-2026-44036

A flaw was found in DCMTK's XML-to-DICOM converter. An attacker can exploit this vulnerability by supplying a crafted XML file containing deeply nested elements. When parsed, this input triggers uncontrolled recursion that exhausts stack memory and crashes the application, resulting in a Denial o...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

CVE-2026-19498

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to cause a denial of service due to uncontrolled recursion...

CVE-2026-19498 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to cause a denial of service due to uncontrolled recursion...

CVE-2026-19498

The IBM Security Verify Access Appliance (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3) are vulnerable to a denial of service attack caused by uncontrolled recursion (CWE-674). A remote attacker can exploit this flaw to disrupt service availability....

EUVD-2026-95275

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to cause a denial of service due to uncontrolled recursion...

CVE-2026-26903-PoC

CVE-2026-26903 PoC Déni de service via récursion illimitée dans la fonctionreplaceEqualDeep de TanStack Query Une seule mise à jour de requête contenant des objets profondément imbriqués peut geler le thread JavaScript indéfiniment , rendant l'application totalement inutilisable. Aucune...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

CVE-2026-39376

CVE-2026-39376 CVE-2026-39376 бесконечный цикл перенаправления DoS через цепочку meta-refresh Краткое описание Когда parse получает URL, который возвращает HTML-страницу, содержащую тег , она рекурсивно вызывает саму себя с URL перенаправления — без ограничения глубины, без дедупликации посещённы...

GHSA-3C6W-J9XM-8H2H Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

Summary The JSON response body processor parses response bodies with no recursion limit. ProcessResponse calls readJSONss, ignoreJSONRecursionLimit, and that constant is -1. The guard in readItems only fires on == 0, so counting down from -1 -2, -3, ... never reaches it. The guard is effectively...

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

Summary The JSON response body processor parses response bodies with no recursion limit. ProcessResponse calls readJSONss, ignoreJSONRecursionLimit, and that constant is -1. The guard in readItems only fires on == 0, so counting down from -1 -2, -3, ... never reaches it. The guard is effectively...

CVE-2026-107300 msgpack5: Many buffered values can exhaust the streaming decoder stack

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...

EUVD-2026-95111

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete MessagePack value remaining in a chunk. A remote peer can send one chunk containing many small valid values, causing recursion proportional to th...

CVE-2026-107300

The msgpack5 library, a msgpack v5 implementation for node.js and the browser , is vulnerable to a stack exhaustion issue in versions prior to 6.1.0 . The streaming decoder recursively invokes itself for every complete MessagePack value found within a chunk. A remote peer can exploit this by send...

CVE-2026-34308

CVE-2026-34308: MySQL Server компонент JSON отказ в обслуживании Официальный бюллетень вендора: Oracle Critical Patch Update Advisory — April 2026. Сводка из опубликованного CVE Уязвимость в Oracle MySQL Server компонент: Server: JSON. Поддерживаемые затронутые версии: 8.0.0–8.0.45 , 8.4.0–8.4.8 ...

CVE-2025-61301

CVE-2025-61301 - CAPEv2 : Déni d'analyse via le fork récursif de processus Description Une vulnérabilité de haute sévérité de type déni d'analyse affecte reporting/mongodb.py et reporting/jsondump.py dans CAPEv2 commit 52e4b43, le 17 mai 2025 permet à des attaquants pouvant soumettre des...

CVE-2026-105827

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2026-44037

A flaw was found in dcmtk. An attacker can cause a Denial of Service DoS by providing a crafted DICOM Digital Imaging and Communications in Medicine JSON document containing deeply nested sequence values. Processing this input triggers uncontrolled recursion in the JSON parser, causing stack memo...

CVE-2026-44035

A flaw was found in DCMTK. An attacker could exploit this vulnerability by enticing a user or service to process a specially crafted DICOM directory DICOMDIR file containing deeply nested directory records. This issue triggers uncontrolled recursion during record processing, causing stack memory...

CVE-2026-44033

A flaw was found in dcmtk. An attacker can trigger uncontrolled recursion by tricking a user or application into parsing a specially crafted XML document containing deeply nested elements. This flaw leads to stack exhaustion, causing the application to crash and resulting in a Denial of Service D...