PT-2026-120558

Uncontrolled recursion in the mcpack2pb component in Apache bRPC version 1.18.0 on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data. Root Cause: The bRPC mcpack2pb parser used to serve nshead mcpack / ubrpc / public pbrpc requests recursively...

dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network...

dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network...

dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network...

dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network...

dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network...

dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network...

dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network...

dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network...

CVE-2026-112368

A flaw was found in the MongoDB PHP driver. An uncontrolled recursion vulnerability in the Binary JSON BSON decoding logic allows an unauthenticated remote attacker to cause a Denial of Service DoS. By supplying specially crafted binary document data to the decoder, an attacker can exhaust the...

CVE-2026-96289

A flaw was found in Apache Thrift's PHP bindings. A remote attacker could cause a denial of service DoS by sending specially crafted input that triggers uncontrolled recursion. This excessive recursion can exhaust system resources or stack space, leading to an application crash...

CVE-2026-96288

A flaw was found in Apache Thrift's Erlang bindings. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending specially crafted input that triggers uncontrolled recursion and unrestricted resource allocation. As a result, the application can exhaust available system...

Linux Distros Unpatched Vulnerability : CVE-2026-112368

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary documen...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via linearizepagetree in src/PIL/PdfParser.py, where a PDF file containing a deeply nested page tree causes unbounded recursion that exhausts the call stack. An attacker can supply a malicious PDF with an...

CVE-2026-8168

A flaw was found in the Qt SVG module. A remote attacker could trigger this issue by providing a specially crafted SVG Scalable Vector Graphics file containing deeply nested elements. When parsed, this leads to uncontrolled recursion and stack exhaustion, resulting in an application crash and a...

CVE-2026-93450

A flaw was found in the go-openapi/swag library's jsonutils component. This vulnerability, caused by uncontrolled recursion during ordered JSON JavaScript Object Notation parsing and serialization, allows remote unauthenticated attackers to submit deeply nested JSON documents. This can lead to a...

CVE-2026-110263

A flaw was found in OW2 ASM. An attacker could cause a Denial of Service DoS by providing a specially crafted Java class file containing deeply nested generic type signatures. When the library parses these signatures using the SignatureReader component, uncontrolled recursion exhausts available...

CVE-2026-112368

An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting ...

EUVD-2026-104414

An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting ...

CVE-2026-112368

An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting ...