CVE-2026-102510

Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache PLC4X PLC4Go allow a malicious device, or an attacker able to inject network traffic, to crash or exhaust the memory of the client...

brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns

A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service DoS by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the...

EUVD-2026-89679

Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache PLC4X PLC4Go allow a malicious device, or an attacker able to inject network traffic, to crash or exhaust the memory of the client...

EUVD-2026-89678

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X PLC4J allow a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service. In the O...

CLEANSTART-2026-OJ74202 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the minio-operator package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

EUVD-2026-89554

Uncontrolled recursion in the Gosub browser engine gosub-engine through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service stack exhaustion and application crash via an SVG document containing an excessive number of deeply nested elements. Because the engin...

CVE-2026-103118: Uncontrolled Recursion

A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is...

PT-2026-103083

Name of the Vulnerable Software and Affected Versions Apache PLC4X versions 0.11.0 through 0.13.1 Description The Go implementation of Apache PLC4X PLC4Go contains multiple flaws including integer overflow, improper validation of array indices, uncontrolled recursion, and memory allocation with...

AlmaLinux 9.2 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778133583)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778133583 advisory. - vim is vulnerable to Heap-based Buffer Overflow CVE-2021-3875, CVE-2022-0158 - NULL Pointer Dereference in GitHub repository vim/v...

CVE-2026-102509: Memory Allocation with Excessive Size Value

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X PLC4J allow a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service. In the O...

PT-2026-103272

Name of the Vulnerable Software and Affected Versions GraphicsMagick versions prior to 1.3.48 Description The WPG File Handler component contains a flaw in the ExtractPostscript function within the coders/wpg.c file. A remote attacker can trigger uncontrolled recursion through specific...

Oracle Linux 8 : postgresql:12 (ELSA-2026-72274)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-72274 advisory. - add postgresql-CVE-2026-18408.patch - apply backport-of-the-patch-to-fix-CVE-2025-8714.patch - Resolves: CVE-2026-14662, CVE-2026-14664,...

Linux Distros Unpatched Vulnerability : CVE-2026-102473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dash. When built without libc fnmatch, the internal pmatch matcher implements by unbounded recursion over candidate positions. A local user...

AlmaLinux 9.2 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc (ALMALINUX9.2:CLSA-2026:1786470878)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786470878 advisory. - Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP...

AlmaLinux 9.2 [TuxCare] Security Update: jq / jq-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778142360)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778142360 advisory. - jq is a command-line JSON processor. In versions 1.8.1 and below, functions jvsetpath, jvgetpath, and delpathssorted in jq's...

CentOS Linux 7 [TuxCare] Security Update: apr-util / apr-util-devel / apr-util-ldap / apr-util-mysql / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1786495987)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1786495987 advisory. - A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrust...

AlmaLinux 9.2 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-static / python3-libxml2 (ALMALINUX9.2:CLSA-2025:1759411642)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1759411642 advisory. - Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow...

AlmaLinux 9.6 [TuxCare] Security Update: apr-util / apr-util-bdb / apr-util-devel / apr-util-ldap / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786481279)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786481279 advisory. - A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from...

Rocky Linux 9.6 [TuxCare] Security Update: apr-util / apr-util-bdb / apr-util-devel / apr-util-ldap / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786481279)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786481279 advisory. - A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from...

GHSA-QHR7-859C-M2P7 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

Summary expand recurses once per level of brace nesting. Deeply nested input exhausts the native stack and crashes the process. This is distinct from CVE-2026-14257 / GHSA-mh99-v99m-4gvg, which made the tail iterative recursion on m.post, driven by how many groups are chained. Nesting depth drive...