CVE-2026-26903-PoC

CVE-2026-26903 PoC Denial-of-service via unbounded recursion in TanStack Query'sreplaceEqualDeep function A single crafted query update with deeply nested objects can freeze the JavaScript thread indefinitely , causing complete application unresponsiveness. No authentication or special permission...

GO-2026-6549 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/dasel

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/dasel...

CVE-2026-39376

CVE-2026-39376 CVE-2026-39376Infinite redirect loop DoS via meta-refresh chain Summary When parse fetches a URL that returns an HTML page containing a tag, it recursively calls itself with the redirect URL — with no depth limit, no visited-URL deduplication, and no redirect count cap. An...

BIT-PHP-MIN-2026-91765 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...

BIT-PHP-2026-91765 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...

BIT-LIBPHP-2026-91765 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...

Rocky Linux 8 [CIQ] Security Update: perl-Net-DNS (crlsa-2026_68787)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202668787 advisory. perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records CVE-2026-81928 Tenable has extracted the preceding description block...

Rocky Linux 10.2 [CIQ] Security Update: p11-kit / p11-kit-client / p11-kit-client-debuginfo / etc (crlsa-2026_49668)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202649668 advisory. p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing CVE-2026-13757 Tenable has extracted the preceding description block directly from th...

Rocky Linux 8 [CIQ] Security Update: resource-agents / resource-agents-aliyun / etc (crlsa-2026_13902)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202613902 advisory. pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion CVE-2026-30922 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9.6 [TuxCare] Security Update: jq / jq-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1778143159)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778143159 advisory. - jq is a command-line JSON processor. In versions 1.8.1 and below, functions jvsetpath, jvgetpath, and delpathssorted in jq's...

Rocky Linux 10.1 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc Multiple Vulnerabilities (crlsa-2026_13916)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202613916 advisory. pyjwt: PyJWT accepts unknown crit header extensions RFC 7515 ?4.1.11 MUST violation CVE-2026-32597 pyasn1: pyasn1 Vulnerable to Denial of Service via...

CentOS Linux 7 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1786448352)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1786448352 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. befor...

Rocky Linux 9 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc (crlsa-2026_13917)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202613917 advisory. pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion CVE-2026-30922 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: krb5-debuginfo / krb5-debugsource / krb5-devel / etc (crlsa-2021_1593)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20211593 advisory. krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1encode.c may lead to DoS CVE-2020-28196 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: p11-kit / p11-kit-client / p11-kit-client-debuginfo / etc (crlsa-2026_49667)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202649667 advisory. p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing CVE-2026-13757 Tenable has extracted the preceding description block directly from the C...

Rocky Linux 10.2 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc Multiple Vulnerabilities (crlsa-2026_19138)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619138 advisory. pyjwt: PyJWT accepts unknown crit header extensions RFC 7515 ?4.1.11 MUST violation CVE-2026-32597 pyasn1: pyasn1 Vulnerable to Denial of Service via...

AlmaLinux 9.2 [TuxCare] Security Update: jq / jq-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778142360)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778142360 advisory. - jq is a command-line JSON processor. In versions 1.8.1 and below, functions jvsetpath, jvgetpath, and delpathssorted in jq's...

Linux Distros Unpatched Vulnerability : CVE-2026-102473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dash. When built without libc fnmatch, the internal pmatch matcher implements by unbounded recursion over candidate positions. A local user...

AlmaLinux 9.2 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc (ALMALINUX9.2:CLSA-2026:1786470878)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786470878 advisory. - Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP...

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

Summary parseCommaParts can exhaust the native stack and crash the process. There are two distinct ways to trigger it, both reachable from a single untrusted pattern string. This is the parsing-side counterpart to CVE-2026-14257 / GHSA-mh99-v99m-4gvg. That fix made expand iterative and documented...