CVE-2026-106447: Uncontrolled Recursion

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR arrays, maps, and tags through decodeValue without enforcing a maximum nesting depth. A sufficiently deep structure exhausts the JavaScript call...

ROS-20261006-73-0040

The vulnerability of the apparmor component in the Linux operating system’s kernel is related to an uncontrolled recursion. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-105854: Uncontrolled Resource Consumption

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource...

CVE-2026-106449: Uncontrolled Recursion

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill, allowing a long sequence of empty blocks in an attacker-controlled compresse...

CVE-2026-106186: Uncontrolled Search Path Element

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: Low...

CVE-2026-102409: Uncontrolled Recursion

Uncontrolled Recursion CWE-674 in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation CAPEC-130...

CVE-2026-103008: Uncontrolled Recursion

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds...

Elasticsearch 9.0.x < 9.4.8 / 9.5.x < 9.5.5 DoS (ESA-2026-198)

The version of Elasticsearch installed on the remote host is 9.0.x prior to 9.4.8, or 9.5.x prior to 9.5.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-198 advisory. - Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially...

Elasticsearch 9.0.x < 9.4.6 / 9.5.x < 9.5.2 DoS (ESA-2026-196)

The version of Elasticsearch installed on the remote host is 9.0.x prior to 9.4.6, or 9.5.x prior to 9.5.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-196 advisory. - Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially...

PT-2026-107155

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Uncontrolled Resource Consumption in the query processing engine allows a low-privileged authenticated user to submit a specially crafted query. This action causes uncontrolled memory...

Security Bulletin: Due to the use of Spring Expression Language (SpEL), IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-47886)

Summary Spring Expression Language SpEL is used by IBM Sterling Control Center as part of dependency in spring-expression-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-47886 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a...

Security Bulletin: Multiple vulnerabilities within WebSphere Application Server Liberty, affect IBM Tivoli Monitoring.

Summary Multiple vulnerabilities within KCCI WebSphere Liberty Server which is included as part of IBM Tivoli Monitoring ITM portal server have been addressed. Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in js-yaml

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in js-yaml. CVE-2026-84375 The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-84375 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. From 3.0.0...

Adobe Bridge Uncontrolled Recursion

The vulnerability of the Adobe Bridge file manager is related to an uncontrolled recursion. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

UriParser ParseMustBeSegmentNzNc Heap Buffer Overflow DoS

The vulnerability of the ParseMustBeSegmentNzNc function in the src/UriParse.c file of the UriParser parser is related to an uncontrolled recursion. Exploiting this vulnerability could allow an attacker to cause a service failure...

Pillow Heap Buffer Overflow DoS

The vulnerability of the loadbitmaps function in the PIL/PcfFontFile.py file from the Python Pillow image processing library is related to uncontrolled memory allocation. Exploiting this vulnerability could allow an attacker to cause a service failure...

Pillow bdf_char Heap Buffer Overflow DoS

The vulnerability of the bdfchar function in the PIL/BdfFontFile.py library for working with images in the Python Pillow library is related to uncontrolled memory allocation. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Pillow GdImageFile Heap Buffer Overflow DoS

The vulnerability of the GdImageFile.open function in the PIL/GdImageFile.py library for working with images in the Python Pillow library is related to uncontrolled memory allocation. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Pillow FontFile Compile Heap Buffer Overflow DoS

The vulnerability of the FontFile.compile function in the PIL/FontFile.py library for working with images in the Python Pillow library is related to uncontrolled memory allocation. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

ROS-20261005-73-0122

The vulnerability of the ucanreadbulkcallback function in the drivers/net/can/usb/ucan.c file of the Linux network device driver framework leads to uncontrolled resource consumption. Exploiting this vulnerability could allow an attacker to cause service failures...