71 matches found
CVE-2026-61846: rgrove crass: Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises...
GHSA-6JXJ-PX6V-747W Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
Impact Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises SystemStackError: stack level too deep, or can cause excessive memory usage. Patches This is fixed in Crass 1.0.7,...
EUVD-2026-83121
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted fits stream containing consecutive 2880-byte header blocks without the mandatory end keyword makes...
CVE-2026-59156
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted fits stream containing consecutive 2880-byte header blocks without the mandatory end keyword makes...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: bind (UTSA-2023-003035)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003035 advisory. The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the...
Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service
Impact Feeding a KCL program that wraps an expression in deep, unnecessary parentheses triggers the parser’s recursive expression - unnecessarilybracketed - expression path. With enough nesting, the call stack grows until it exceeds the process stack limit, causing a stack overflow...
GHSA-JGVR-6X5W-HX5W Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service
Impact Feeding a KCL program that wraps an expression in deep, unnecessary parentheses triggers the parser’s recursive expression - unnecessarilybracketed - expression path. With enough nesting, the call stack grows until it exceeds the process stack limit, causing a stack overflow...
CVE-2026-69220
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively f...
CVE-2026-69220
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively f...
CVE-2026-69220
In RabbitMQ Java client
CVE-2026-69220
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively f...
PT-2026-77214
Name of the Vulnerable Software and Affected Versions RabbitMQ Java client library versions prior to 5.33.1 Description In the ValueReader.java file, the readTable and readArray functions call readFieldValue recursively for AMQP table type F and AMQP array type A values without a nesting-depth...
Unity Linux 20.1070e Security Update: perl-Mojolicious (UTSA-2026-099533)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099533 advisory. Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path decodevalue dispatching ...
CVE-2026-74783
Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger ...
EUVD-2026-59949
Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger ...
PT-2026-73151
Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger ...
CVE-2026-19617
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the...
DEBIAN-CVE-2026-19617
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the...
CVE-2026-19617
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the...
CVE-2026-19617
A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the...