cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=4790812572188672 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=6092688160784384 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=6148494029815808 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

GO-2026-5684 Go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth in github.com/ipld/go-ipld-prime

Go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth in github.com/ipld/go-ipld-prime...

CVE-2026-15957

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-...

CVE-2026-15957: Allocation of Resources Without Limits or Throttling

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-...

jsoncons:fuzz_cbor_parser_max: Heap-buffer-overflow in jsoncons::cbor::basic_cbor_parser<jsoncons::stream_source<unsigned char, std::__

Project: https://github.com/danielaparker/jsoncons.git Detailed Report: https://oss-fuzz.com/testcase?key=5246852585553920 Project: jsoncons Fuzzing Engine: honggfuzz Fuzz Target: fuzzcborparsermax Job Type: honggfuzzasanjsoncons Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

jsoncons:fuzz_cbor: Heap-buffer-overflow in jsoncons::cbor::basic_cbor_parser<jsoncons::stream_source<unsigned char, std::__

Project: https://github.com/danielaparker/jsoncons.git Detailed Report: https://oss-fuzz.com/testcase?key=5082885028380672 Project: jsoncons Fuzzing Engine: libFuzzer Fuzz Target: fuzzcbor Job Type: libfuzzerasanjsoncons Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

GO-2026-5073 DAG-CBOR decoder unbounded memory allocation from CBOR headers in github.com/ipld/go-ipld-prime

DAG-CBOR decoder unbounded memory allocation from CBOR headers in github.com/ipld/go-ipld-prime...

PYSEC-2026-282 APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

The JSONSerializer and CBORSerializer in APScheduler all versions including 3.10.x and 4.0.0a5 are vulnerable to Remote Code Execution RCE via Insecure Deserialization. The unmarshalobject function allows for arbitrary class instantiation and state injection by dynamically importing modules and...

ROOT-APP-MAVEN-CVE-2020-28491 CVE-2020-28491 in io.root.com.fasterxml.jackson.dataformat:jackson-dataformat-cbor - Patched by Root

Root has patched CVE-2020-28491 in the io.root.com.fasterxml.jackson.dataformat:jackson-dataformat-cbor package for Root:Maven. Multiple fixed versions available...

jsoncons:fuzz_cbor_encoder: Heap-use-after-free in jsoncons::cbor::cbor_mdarray_row_major_iterator<jsoncons::stream_source<unsigned

Project: https://github.com/danielaparker/jsoncons.git Detailed Report: https://oss-fuzz.com/testcase?key=4834232383111168 Project: jsoncons Fuzzing Engine: libFuzzer Fuzz Target: fuzzcborencoder Job Type: libfuzzerasanjsoncons Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...

jsoncons:fuzz_cbor_encoder: Bad-cast to jsoncons::cbor::cbor_mdarray_row_major_iterator<jsoncons::stream_source<unsigned char>, std::allocator<char>> from invalid vptr in jsoncons::cbor::cbor_mdarray_row_major_iterator<jsoncons::stream_source<unsigned

Project: https://github.com/danielaparker/jsoncons.git Detailed Report: https://oss-fuzz.com/testcase?key=4549385555083264 Project: jsoncons Fuzzing Engine: libFuzzer Fuzz Target: fuzzcborencoder Job Type: libfuzzerubsanjsoncons Platform Id: linux Crash Type: Bad-cast Crash Address: 0x5b1f102138e...

SUSE CVE-2026-42328

go-ipld-prime is an implementation of the InterPlanetary Linked Data IPLD spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.23.0, the DAG-CBOR and DAG-JSON decoders recurse on each nested map or list...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the DAG-CBOR and DAG-JSON decoders. An attacker can cause a fatal stack overflow by submitting payloads with deeply nested collections. Remediation Upgrade github.com/ipld/go-ipld-prime/codec/dagcbor to...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the DAG-CBOR and DAG-JSON decoders. An attacker can cause a fatal stack overflow by submitting payloads with deeply nested collections. Remediation Upgrade github.com/ipld/go-ipld-prime/codec/dagjson to...

CVE-2026-42328 go-ipld-prime: DAG-CBOR and DAG-JSON decoders unbounded recursion depth

go-ipld-prime is an implementation of the InterPlanetary Linked Data IPLD spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.23.0, the DAG-CBOR and DAG-JSON decoders recurse on each nested map or list...

CVE-2026-42328

CVE-2026-42328 : go-ipld-prime prior to 0.23.0 had unbounded recursion in the DAG-CBOR and DAG-JSON decoders when processing deeply nested maps/lists. Each nesting level increases the goroutine stack, potentially causing a fatal stack overflow. The issue is resolved by a fix in version 0.23.0 . I...

CVE-2026-42328 go-ipld-prime: DAG-CBOR and DAG-JSON decoders unbounded recursion depth

go-ipld-prime is an implementation of the InterPlanetary Linked Data IPLD spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.23.0, the DAG-CBOR and DAG-JSON decoders recurse on each nested map or list...

CVE-2026-42328

go-ipld-prime is an implementation of the InterPlanetary Linked Data IPLD spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.23.0, the DAG-CBOR and DAG-JSON decoders recurse on each nested map or list...