2471 matches found
Uncontrolled Recursion
Overview mercurius is a GraphQL adapter for Fastify Affected versions of this package are vulnerable to Uncontrolled Recursion in the subscription queries received over WebSocket connections. An attacker can bypass intended query depth restrictions by submitting deeply nested subscription queries...
Mercurius's queryDepth limit bypassed for WebSocket subscriptions
Description Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation...
GHSA-M4H2-MJFM-MP55 Mercurius's queryDepth limit bypassed for WebSocket subscriptions
Description Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are parsed and executed without invoking the depth validation...
EUVD-2026-10081
Mercurius's queryDepth limit bypassed for WebSocket subscriptions...
python: protobuf: Protobuf: Denial of Service due to recursion depth bypass
A flaw was found in protobuf. A remote attacker can exploit this denial-of-service DoS vulnerability by supplying deeply nested google.protobuf.Any messages to the google.protobuf.jsonformat.ParseDict function. This bypasses the intended recursion depth limit, leading to the exhaustion of Python’...
CVE-2026-29062
A flaw was found in jackson-core. A user could exploit this vulnerability by supplying a specially crafted JSON document with excessive nesting. This bypasses a security constraint designed to limit nesting depth, which can cause a system crash StackOverflowError when the document is processed...
SUSE-SU-2026:20657-1 Security update for libxslt, libxml2
This update for libxslt, libxml2 fixes the following issues: libxml2: - CVE-2026-0990: call stack overflow leading to application crash due to infinite recursion in xmlCatalogXMLResolveURI bsc1256807, bsc1256811 - CVE-2026-0992: excessive resource consumption when processing XML catalogs due to...
python: protobuf: Protobuf: Denial of Service due to recursion depth bypass
A flaw was found in protobuf. A remote attacker can exploit this denial-of-service DoS vulnerability by supplying deeply nested google.protobuf.Any messages to the google.protobuf.jsonformat.ParseDict function. This bypasses the intended recursion depth limit, leading to the exhaustion of Python’...
CVE-2026-29062
CVE-2026-29062 affects jackson-core: from 3.0.0 up to before 3.1.0, the UTF8DataInputJsonParser (used when parsing from java.io.DataInput) bypasses the StreamReadConstraints maxNestingDepth (default 500), allowing excessively nested JSON to cause a StackOverflowError and a resulting DoS. A simila...
CVE-2026-29062 jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion
jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constrai...
CVE-2026-29062 jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion
jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constrai...
CVE-2026-29062 jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion
jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constrai...
CVE-2026-29062
jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constrai...
PT-2026-23759
Name of the Vulnerable Software and Affected Versions Mercurius versions prior to 16.8.0 Description Mercurius does not properly enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check functions as expected for HTTP queries and...
FasterXML jackson-core 安全漏洞
FasterXML jackson-core is an open-source API software developed by FasterXML. Versions of FasterXML jackson-core from 3.0.0 to 3.1.0 contained security vulnerabilities. These vulnerabilities stemmed from bypassing the nested depth limit during JSON parsing, which could lead to stack overflows and...
CVE-2026-29062
jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constrai...
Mercurius 安全漏洞
Mercurius is an open-source GraphQL adapter developed by mercurius-js. Versions of Mercurius prior to 16.8.0 contained a security vulnerability. This vulnerability stemmed from the lack of enforcement of the queryDepth limit for GraphQL subscription queries received via WebSocket connections. As ...
jackson-core has Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion
Summary The UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint default: 500 defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive...
GHSA-6V53-7C9G-W56R jackson-core has Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion
Summary The UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput source, bypasses the maxNestingDepth constraint default: 500 defined in StreamReadConstraints. A similar issue was found in ReaderBasedJsonParser. This allows a user to supply a JSON document with excessive...