CVE-2026-101918

A flaw was found in PyJWT. When processing a JSON Web Token JWT prior to signature verification, the parser fails to properly handle deeply nested data, leading to an unhandled recursion error. A remote unauthenticated attacker could exploit this flaw by submitting a specially crafted token,...

CVE-2026-102278

The brace-expansion library is vulnerable to a process-terminating denial of service due to uncontrolled recursion during nested brace group expansion. Prior to versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11 , providing an untrusted pattern with deeply nested brace alternatives or single-part sets cau...

CVE-2026-102276 brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and use...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

MGASA-2026-0460 Updated p11-kit packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Stack exhaustion via unbounded recursion in rpc attribute parsing. CVE-2026-13757 Integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems. CVE-2026-18938...

Updated p11-kit packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Stack exhaustion via unbounded recursion in rpc attribute parsing. CVE-2026-13757 Integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems. CVE-2026-18938...

Updated php package fixes security vulnerabilities

FILTERSANITIZEENCODED does not encode 0xFF IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address comparison Various packet overreads in mysqlnd wire protocol TLS hostname verification falls back to CN after SAN mismatch Heap buffer overflow in phpopensslmatcheswildcardname on...

MGASA-2026-0458 Updated php package fixes security vulnerabilities

FILTERSANITIZEENCODED does not encode 0xFF IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address comparison Various packet overreads in mysqlnd wire protocol TLS hostname verification falls back to CN after SAN mismatch Heap buffer overflow in phpopensslmatcheswildcardname on...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

PT-2026-102377

Name of the Vulnerable Software and Affected Versions brace-expansion versions prior to 1.1.20 brace-expansion versions prior to 2.1.6 brace-expansion versions prior to 3.0.8 brace-expansion versions prior to 5.0.11 Description Deeply nested brace groups supplied as an untrusted pattern can cause...

Important: qt5-qtbase

Issue Overview: Uncontrolled recursion in Qt's QDomDocument serialization QtXml lets deeply nested untrusted XML crash the app via stack exhaustion DoS only. CVE-2026-11573 QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input...

CVE-2026-102278: Uncontrolled Resource Consumption

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before...

CVE-2026-75758

A flaw was found in the Elixir standard library. An attacker who controls a list can trigger an uncontrolled recursion vulnerability by passing a specially crafted list to functions like inspect/1, List.tostring/1, or List.tocharlist/1. This leads to the exhaustion of a BEAM node's memory,...

Uncontrolled Recursion

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Uncontrolled Recursion via parseAddresses in src/mime-node/index.ts when a recipient field is supplied as a deeply nested array. The native array-to-string...

CLEANSTART-2026-FL18888 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the loki package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CVE-2026-91765

cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...

AZL-104919 CVE-2026-91765 affecting package php 8.3.33-1

cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...

UBUNTU-CVE-2026-91765

cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...

CVE-2026-91765

cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...