CVE-2026-115290

A flaw was found in Elasticsearch. An unauthenticated remote attacker with network access to a node's remote cluster server interface can send specially crafted requests containing deeply nested serialized data. Processing this data triggers excessive recursion, causing the affected node to crash...

CVE-2026-115716 Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in APM Server can lead to denial of service via Oversized Serialized Data Payloads CAPEC-231. An attacker who can send OpenTelemetry OTLP data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops...

CVE-2026-115716 Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in APM Server can lead to denial of service via Oversized Serialized Data Payloads CAPEC-231. An attacker who can send OpenTelemetry OTLP data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops...

CVE-2026-115716

The APM Server is vulnerable to a Denial of Service (DoS) due to Allocation of Resources Without Limits or Throttling (CWE-770) . An attacker can send Oversized Serialized Data Payloads (CAPEC-231) via OpenTelemetry (OTLP) data over HTTP , causing the server to exhaust its memory and terminate. T...

EUVD-2026-116072

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate...

Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-201)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An unauthenticated attacker with network access to the remote cluster server interface of a node c...

CVE-2026-115716: Elastic APM Server: Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via…

Allocation of Resources Without Limits or Throttling CWE-770 in APM Server can lead to denial of service via Oversized Serialized Data Payloads CAPEC-231. An attacker who can send OpenTelemetry OTLP data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops...

CVE-2026-16760

A flaw was found in fickling. This flaw allows arbitrary code execution when an application processes untrusted serialized data. Because fickling inherently trusts unblocked standard library functions without verifying their actual behavior, it fails to identify dangerous calls within serialized...

CLEANSTART-2026-FS66551 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230)

Security vulnerability affects the sonarqube package. Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230...

CVE-2026-116583

A flaw was found in seroval. A remote attacker could achieve arbitrary code execution in an application or web page that processes serialized data. When an application serializes a typed array containing untrusted properties, seroval improperly derives constructor names from attacker-controlled...

CLEANSTART-2026-UD61469 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230)

Security vulnerability affects the sonarqube package. Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230...

PT-2026-135191

Security vulnerability affects the sonarqube package. Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230...

CLEANSTART-2026-IB65674 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230)

Security vulnerability affects the sonarqube package. Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230...

CVE-2026-87962 t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or...

EUVD-2026-75387

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or...

CVE-2026-87962

t-digest versions 3.1 through 3.3 (a Java library for approximate quantile estimation maintained by tdunning on GitHub) contain a denial of service vulnerability in MergingDigest.fromBytes . The root cause is a failure to validate length and capacity fields read from serialized data; a crafted se...

CVE-2026-87962 t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or...

CVE-2026-87962: Improper Validation of Specified Quantity in Input

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or...

PT-2026-89360

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or...

CVE-2026-82797

A flaw was found in rlottie. This uncontrolled recursion vulnerability allows a local attacker to cause a denial of service DoS by providing specially crafted serialized data with nested payloads. Successful exploitation requires user interaction to process the malicious data. Mitigation Update...