CLEANSTART-2026-AJ83096 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Multiple security vulnerabilities affect the logstash-exporter package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details...

CVE-2026-22591

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering DDSSQLFilter allows any participant in a DDS domain to remotely...

CVE-2026-442_

CVE protobuf.js CVE-2026-44289、CVE-2026-44290、CVE-2026-44291、CVE-2026-44292、CVE-2026-44294、CVE-2026-44295 - protobuf.js ⚡ 简单用法 仅在安全且授权的环境中使用此项目，例如： 本地虚拟机 Docker 容器 隔离的实验环境 经授权的渗透测试环境 配置示例： root@kitploit: git clone cd 项目使用 Python，请遵循以下步骤 创建虚拟环境 python -m venv venv 激活虚拟环境 macOS / Linux source...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

CVE-2025-21574-Exploit

CVE-2025-21574-Exploit 此黑盒漏洞利用脚本的主要功能： 1. 凭据暴力破解： 测试 12 种以上常见的默认用户名/密码组合 检查 5 个常见的系统数据库 自动检测有效凭据 2. 匿名访问尝试： 尝试不使用任何凭据进行连接 如果启用了匿名访问，则测试所有数据库 3. 漏洞利用阶段： 使用 150,000+ 层嵌套以达到最大影响 自动检测服务器崩溃症状 测试所有有效的凭据/数据库组合 4. 错误处理： 区分连接错误与成功崩溃 优雅地处理各种 MySQL 错误情况 使用说明： 1. 将 TARGETIP 替换为目标服务器的 IP 地址 2. 安装先决条件：pip...

toml-node: Uncontrolled Recursion

Summary toml.parse crashes with an uncaught RangeError: Maximum call stack size exceeded when parsing deeply nested arrays or inline tables. The parser is generated by Peggy 5.1.0 a PEG parser generator as a recursive-descent parser; the value rule mutually recurses with the array and inline-tabl...

CVE-2026-81724 NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed...

Astra Linux – Vulnerability in libxml-parser-perl

XML::Parser versions up to 2.47 for Perl have a heap buffer overflow issue in stserialstack. In the case where stackptr == stacksize - 1, the stack will NOT be expanded. As a result, the new value will be written at location ++stackptr, which equals stacksize. This means that the new value falls...

BIT-GOLANG-2026-33818 Enforce maximum recursion depth in encoding/asn1

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CVE-2026-74783

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger ...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

PT-2026-84462

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.16.1 Description An attacker can craft a PDF file that causes the get outline function in pypdf/ doc common.py to consume excessive memory and long runtimes. This occurs when retrieving document outlines that contain ...

AZL-96686 CVE-2026-33818 affecting package golang 1.24.13-2

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CVE-2026-67216

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

AZL-94407 CVE-2026-67216 affecting package apparmor 3.1.7-1

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

EUVD-2026-48578

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes th...

CVE-2026-15957

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-...

Uncontrolled Recursion

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Uncontrolled Recursion in the defaultVisitor function of lib/helpers/toFormData.js, which calls JSON.stringify on a value when its top-level key ends in , before the...

Uncontrolled Recursion

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Uncontrolled Recursion in the defaultVisitor function of lib/helpers/toFormData.js, which calls JSON.stringify on a value when its top-level key ends in ,...

CVE-2026-45133

CVE-2026-45133 affects Symfony YAML parsing: when fed attacker-controlled input, deeply nested mappings/sequences can cause unbounded recursion in both Parser::parseBlock() and Inline::parseSequence()/Inline::parseMapping(), exhausting PHP stack and crashing workers. Affected versions include Sym...