CVE-2026-91765

cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...

CVE-2026-91765

cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...

CVE-2026-91765

cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...

CVE-2026-91765: Uncontrolled Recursion

cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...

CVE-2026-61811

The Wazuh security platform (versions 3.8.0 through 4.14.7 ) is vulnerable to a stack exhaustion issue in the _getattributes() function located in src/os_xml/os_xml.c. The root cause is unbounded recursion that processes XML attributes without a depth limit while allocating large local buffers in...

PT-2026-98284

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The SOAP XML parser contains a flaw where the cleanup xml node function recurses once per XML nesting level without a depth limit. An unauthenticated attacker ca...

CVE-2026-62296

A flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. The XHTML narrative parser does not limit element nesting depth, which allows a deeply nested narrative to trigger unbounded recursion. A remote attacker can exploit this vulnerability by submitting FHIR resources...

php: php: Denial of Service via unbounded recursion in SOAP parser

A flaw was found in PHP. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted request to an affected Simple Object Access Protocol SOAP server endpoint. Due to a lack of recursion depth limits when parsing deeply nested XML elements, processing suc...

CVE-2026-59156

A flaw was found in OpenImageIO, a toolset for reading, writing, and manipulating image files. A remote attacker could exploit this vulnerability by providing a specially crafted Flexible Image Transport System FITS stream. This stream, containing consecutive header blocks without the mandatory...

Fedora 44 : perl-Net-DNS (2026-57f107ed83)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-57f107ed83 advisory. Update to 1.57 to fix CVE-2026-81928 Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records Tenable has extracted the preceding...

Fedora 43 : perl-Net-DNS (2026-48a4531e02)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-48a4531e02 advisory. Update to 1.57 to fix CVE-2026-81928 Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records Tenable has extracted the preceding...

EUVD-2026-84017

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS...

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Summary dasel's JSON and XML readers parse nested structures with unbounded recursion, one native stack frame per nesting level, with no depth guard. A small sub-10 MB, deeply nested document drives the Go runtime past its goroutine stack limit and triggers a fatal error: stack overflow. This is...

CVE-2026-59168 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/jsonreader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard...

CVE-2026-59168 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/jsonreader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard...

CVE-2026-59168

The Dasel command-line tool and library (versions 3.0.0 through 3.11.0 ) are vulnerable to an unrecoverable Denial of Service (DoS) due to unbounded recursion in the JSON and XML readers. The decodeValue, decodeObject, and decodeArray functions in parsing/json/json_reader.go, along with parseElem...

CVE-2026-59168 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/jsonreader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard...

CVE-2026-68914

Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJONOJSONXS is enabled. An attacker who can supply untrusted JSON to decodejson, fromjson, or j can submit deeply nest...

UBUNTU-CVE-2026-68914

Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJONOJSONXS is enabled. An attacker who can supply untrusted JSON to decodejson, fromjson, or j can submit deeply nest...

MiracleLinux 9 : perl-Net-DNS-1.29-6.el9_8.1 (AXSA:2026-1884:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1884:01 advisory. perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records CVE-2026-81928 Tenable has extracted the preceding description...