2811 matches found
ANT-2026-WG9N02WM · libjxl · Heap Buffer Overflow
heap-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-WG9N02WM: Heap buffer overflow in fast...
GHSA-PWGV-4X5Q-6M9F sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
Summary sqlparse ships hard limits MAXGROUPINGDEPTH=100, MAXGROUPINGTOKENS=10000 intended to bound parsing work on attacker-supplied SQL, but the path that reaches those limits is itself Ondepth per token-group construction. A 1-2 KB SQL payload e.g. SELECT 1 ... with 500-2000 nesting levels, or ...
Unity Linux 20.1070a Security Update: libreoffice (UTSA-2026-099544)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099544 advisory. LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made up of many opening tokens...
CVE-2026-74792 Scriban before 7.0.0 Stack Overflow via nested array initializers
Scriban before 7.0.0 affected versions = 6.6.0 contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path ParseArrayInitializer → ParseExpression → ParseArrayInitializer that is not covered by the ExpressionDepthLimit count...
CVE-2026-74783 Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service
Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger ...
SUSE CVE-2026-56859
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...
encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...
EUVD-2026-58509
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
CVE-2026-56859
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
DEBIAN-CVE-2026-56859
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
AZL-96641 CVE-2026-56859 affecting package golang 1.25.12-1
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
AZL-98637 CVE-2026-56859 affecting package golang 1.27.1-1
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
AZL-96677 CVE-2026-56859 affecting package golang 1.26.7-1
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
UBUNTU-CVE-2026-56859
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
CVE-2026-56859
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
CVE-2026-56859
A Denial of Service vulnerability exists in the golang encoding/xml package due to a flaw in DecodeElement , where the depth counter was improperly reset. This oversight prevents the counter from firing, potentially leading to stack exhaustion when processing certain inputs. The issue is addresse...
CVE-2026-33818 Enforce maximum recursion depth in encoding/asn1
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...
