CVE-2026-62296: Improper Input Validation

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner and parseElement, raisi...

CVE-2026-62295: Improper Input Validation

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested,...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion due to unchecked AMQP 1.0 type nesting in the SectionDecoderImpl and related codec constructors in broker-plugins/amqp-1-0-protocol. An unauthenticated attacker can trigger a StackOverflowError by sending a crafte...

CVE-2026-67590

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

CVE-2026-66274

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service. Mitigati...

PT-2026-68002

Name of the Vulnerable Software and Affected Versions Apache Qpid ProtonJ2 versions prior to 1.2.0 Description A pre-authentication attacker can use type nesting to trigger a StackOverflowError, which may result in a denial of service. A StackOverflowError occurs when the application's call stack...

CVE-2026-67552: Uncontrolled Recursion

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue...

PT-2026-68005

Name of the Vulnerable Software and Affected Versions Apache Qpid Broker-J versions prior to 10.1.0 Description A pre-authentication attacker can cause a StackOverflowError, which may lead to a denial of service, by leveraging type nesting. A StackOverflowError occurs when the application's call...

CVE-2026-68073: Uncontrolled Recursion

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue...

CVE-2026-66274: Uncontrolled Recursion

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue...

PT-2026-67998

Name of the Vulnerable Software and Affected Versions Apache Qpid Proton-Dotnet versions prior to 1.1.0 Description A pre-authentication attacker can use type nesting to trigger a StackOverflowError, which may result in a denial of service. A StackOverflowError occurs when the application's call...

CVE-2026-67590: Uncontrolled Recursion

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

PT-2026-67994

Name of the Vulnerable Software and Affected Versions Apache Qpid Proton-J versions prior to 0.35.0 Description A pre-authentication attacker can use unbounded type nesting to trigger a StackOverflowError, which may result in a denial of service. A StackOverflowError occurs when the application's...

CVE-2026-61387: Improper Cleanup on Thrown Exception

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a...

PT-2026-67697

Name of the Vulnerable Software and Affected Versions Eclipse Milo versions 1.0.0 through 1.1.4 Description Monitored-item quota accounting is not exception-safe, meaning that if item creation fails due to an unchecked error, the server-global reservation is not restored. An unauthenticated remot...

Uncontrolled Recursion

Overview org.bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Uncontrolled Recursion in the force method of LazyEncodedSequence, which parses the deferred SEQUENCE with a fresh ASN1InputStream whose nesting-depth...

CVE-2026-40007: Uncontrolled Recursion

Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipeairgapreceiverenabled=true, the IoTDB AirGap receiver's readLength method calls itself recursively each time it recognises the E-language prefix in socket data, with no depth limit. An unauthenticate...

CVE-2026-9002: Uncontrolled Resource Consumption

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 could allow an adjacent attacker to cause a denial of service due to improper validation in the XDF decoder. The application processes deeply nested Protocol Buffers messages and attacker-controlled length prefixes without sufficient bounds...

jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

Impact Potential Denial-of-Service when attacker sends deeply nested JSON if and only if service: 1. Reads deeply nested 1000s of levels JSON as JsonNode ObjectMapper.readTree 2. Writes out same or modifided node using JsonNode.toString which can consume significant amount of resources with...

CVE-2026-45205

Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles. This issue affects Apache Commons: from 2.2 before 2.15.0. Users are recommended to upgrade to version 2.15.0,...