CVE-2026-85493 Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)

Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-103600

Uncontrolled recursion in the ASN.1 parser Asn1InputStream, Asn1StreamParser in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service via a crafted ASN.1 encoding of deeply nested constructed elements for example SEQUENCE...

CVE-2026-103600

The bc-csharp library by Legion of the Bouncy Castle Inc. (versions before 2.7.0 ) is vulnerable to a denial of service due to uncontrolled recursion in the ASN.1 parser (Asn1InputStream , Asn1StreamParser ). An unauthenticated remote attacker can provide a crafted ASN.1 encoding with deeply nest...

EUVD-2026-91230

Uncontrolled recursion in the ASN.1 parser Asn1InputStream, Asn1StreamParser in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service via a crafted ASN.1 encoding of deeply nested constructed elements for example SEQUENCE...

PT-2026-104121

Uncontrolled recursion in the ASN.1 parser Asn1InputStream, Asn1StreamParser in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service via a crafted ASN.1 encoding of deeply nested constructed elements for example SEQUENCE...

CVE-2026-103600: Uncontrolled Recursion

Uncontrolled recursion in the ASN.1 parser Asn1InputStream, Asn1StreamParser in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service via a crafted ASN.1 encoding of deeply nested constructed elements for example SEQUENCE...

CVE-2026-66858: Uncontrolled Recursion

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

CVE-2026-94650: Uncontrolled Recursion

Uncontrolled Recursion vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

ROS-20261002-73-0134

The vulnerability in Xen is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

PyJWT _load() DoS

The vulnerability of the PyJWS.load function in the jwt/apijws.py file of the PyJWT library is related to an uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2026-105496

Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists which allows uncontrolled recursion in the unknown-key skip path of the...

CVE-2026-83663: Uncontrolled Recursion

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

PT-2026-104327

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An uncontrolled recursion issue exists in the Go bindings. Both Go transports attempt to satisfy a read from a buffered frame; if the frame contains no payload bytes, the system reads the next...

PT-2026-104214

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Uncontrolled recursion occurs within the c glib bindings. Uncontrolled recursion is a condition where a function calls itself without a proper termination condition, potentially leading to a...

PT-2026-104215

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Apache Thrift Erlang bindings contain an issue involving uncontrolled recursion and the allocation of resources without limits or throttling. Recommendations Upgrade to version 0.25.0...

PT-2026-104199

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Uncontrolled recursion occurs within the Dart and Java ME bindings. Uncontrolled recursion is a condition where a function calls itself without a proper termination condition, potentially...

CVE-2026-85493: Uncontrolled Recursion

Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-96288: Uncontrolled Recursion

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-96289: Uncontrolled Recursion

Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-104316

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description Uncontrolled recursion occurs within the PHP bindings of Apache Thrift. Uncontrolled recursion is a condition where a function calls itself without a proper termination condition, potentially...