EUVD-2026-115955

SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it,...

CVE-2026-121423

SurrealDB versions before 3.3.0 are vulnerable to a Denial of Service (DoS) attack due to unbounded recursion in val::Value serialization . Authenticated users can trigger a stack overflow by executing UPDATE statements that wrap a stored array in itself, subsequently triggering the overflow duri...

CVE-2026-121423: surrealdb: SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the…

SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it,...

qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing

A flaw was found in Qt. This vulnerability, specifically an unbounded recursion in the QDomNode destructor during QDomDocument XML parsing, allows a remote attacker to trigger a denial-of-service DoS crash. By processing untrusted XML input, the affected system can become unresponsive, leading to...

CVE-2026-26903-PoC

CVE-2026-26903 PoC Denial-of-service via unbounded recursion in TanStack Query'sreplaceEqualDeep function A single crafted query update with deeply nested objects can freeze the JavaScript thread indefinitely , causing complete application unresponsiveness. No authentication or special permission...

FreeBSD : uriparser -- Denial of Service through Unbound Recursion (65abbad5-da78-11f0-b6d5-843a4b343614)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 65abbad5-da78-11f0-b6d5-843a4b343614 advisory. The URIparser project reports: uriparser through 0.9.9 allows unbounded recursion and stack consumption...

CVE-2026-39376

CVE-2026-39376 CVE-2026-39376Infinite redirect loop DoS via meta-refresh chain Summary When parse fetches a URL that returns an HTML page containing a tag, it recursively calls itself with the redirect URL — with no depth limit, no visited-URL deduplication, and no redirect count cap. An...

FreeBSD : sqlite3 -- multiple vulnerabilities (84cd82e1-d49f-11f1-bae2-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 84cd82e1-d49f-11f1-bae2-3497f65b111b advisory. VulnCheck reports: Ten vulnerabilities fixed in SQLite 3.54.0 were published on 2026-10-30. Fo...

sqlite3 -- multiple vulnerabilities

VulnCheck reports: Ten vulnerabilities fixed in SQLite 3.54.0 were published on 2026-10-30. Four of them corrupt the heap: buffer overflows in the FTS5 functions fts5MergeRowidLists and fts5DoSecureDelete and in the session extension sessionUpdateFind, and a use-after-free in the R-Tree function...

pillow: Pillow: Denial of Service via unbounded recursion in PDF parser

A flaw was found in Pillow. The PDF parser fails to limit recursion depth when reading nested PDF data structures such as arrays and dictionaries. A remote attacker could exploit this vulnerability by supplying a specially crafted, deeply nested PDF file to an application processing PDFs in appen...

CVE-2026-105042 Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash

A message body that is deeply nested and decoded by pnmessagebody could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue...

AlmaLinux 9.2 [TuxCare] Security Update: perl-Net-DNS / perl-Net-DNS-Nameserver (ALMALINUX9.2:CLSA-2026:1793304699)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793304699 advisory. - Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sigdata when re-encoding a message with a misplac...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unbounded recursion during schema validation

A flaw was found in kin-openapi. The runtime schema validation lacks cycle detection when processing circular schema references. A remote attacker can exploit this vulnerability by submitting a request or response that triggers recursive validation, leading to unbounded recursion and stack...

Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process

Description Yaml\Parser::lexInlineStructure recursed through lexInlineMapping and lexInlineSequence for every and of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as ...,...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unbounded recursion during schema validation

A flaw was found in kin-openapi. The runtime schema validation lacks cycle detection when processing circular schema references. A remote attacker can exploit this vulnerability by submitting a request or response that triggers recursive validation, leading to unbounded recursion and stack...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143719)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143719 advisory. cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of...

Amazon Linux 2 : php (ALAS-2026-4015)

The version of php installed on the remote host is prior to 5.4.16-46. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4015 advisory. cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a...

Important: php

Issue Overview: cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounde...

Apache Qpid Proton C API 0.40.0 Remote Stack Overflow

Apache Qpid Proton C API version 0.40.0 contains an unbounded recursion flaw in its AMQP decoder that allows remote unauthenticated peers to exhaust the stack and cause a denial of service. !/usr/bin/env bash Apache Qpid Proton C API 0.40.0 Remote Stack Overflow Vendor: The Apache Software...

Apache Qpid Proton C API 0.40.0 Remote Stack Overflow

Summary Qpid Proton is a high-performance, lightweight messaging library. It can be used in the widest range of messaging applications, including brokers, client libraries, routers, bridges, proxies, and more. Proton makes it trivial to integrate with the AMQP 1.0 ecosystem from any platform,...