CVE-2019-13288-POC

CVE-2019-13288-POC xpdf/install/bin/pdftotext ./poc.pdf In Xpdf 4.01.01, the Parser::getObj function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar to CVE-2018-16646...

CVE-2025-50420

Poppler before version 25.07.0 contains a vulnerability in its pdfseparate utility's PDFDoc processing logic: crafted "/Annots" dictionaries that reference themselves or each other lead to infinite recursion in "PDFDoc::markAnnotations -- PDFDoc::markPageObjects -- PDFDoc::markObject --...

CVE-2025-46206

There is a denial of service vulnerability in MuPDF 1.25.6 and earlier versions. When an attacker runs the "mutool clean poc /dev/null" command, the program will fall into an infinite recursion between the stripoutlines and stripoutline functions in pdf-clean-file.c until the stack is exhausted...

K000164182: Multiple libxml2 vulnerabilities

Security Advisory Description CVE-2017-5130 An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file. CVE-2017-8872 The htmlParseTryOrFinis...

CVE-2026-76181

A flaw was found in LibreOffice. The application's dBASE database driver fails to validate entry counts against page capacity and does not prevent circular page references when parsing index .ndx files. By convincing a user to open a data source with a specially crafted dBASE index file, an...

PT-2026-137720

Name of the Vulnerable Software and Affected Versions LibreOffice affected versions not specified Description A heap buffer overflow occurs when the dBASE database driver reads index files .ndx used as a data source. The issue arises because the number of entries recorded in a page is not validat...

CLEANSTART-2026-JT79950 stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU

Security vulnerability affects the qemu package. A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU...

CLEANSTART-2026-FA43781 infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements

Security vulnerability affects the druid-fips package. An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements...

CVE-2026-65628 Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types

josejwk:sharedsecret/2 exposed in Elixir as JOSE.JWK.sharedsecret/2 derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type kty module, and its fallback clause re-invokes itself as sharedsecretfromYourJWK, fromMyJWK. Because from/...

CVE-2026-65628 Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types

josejwk:sharedsecret/2 exposed in Elixir as JOSE.JWK.sharedsecret/2 derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type kty module, and its fallback clause re-invokes itself as sharedsecretfromYourJWK, fromMyJWK. Because from/...

EEF-CVE-2026-65628 Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types

Summary josejwk:sharedsecret/2 exposed in Elixir as JOSE.JWK.sharedsecret/2 derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type kty module, and its fallback clause re-invokes itself as sharedsecretfromYourJWK, fromMyJWK. Becau...

CVE-2026-65628

The jose library (versions 1.5.0 before 1.11.13 ) is vulnerable to a CPU denial-of-service via infinite recursion in the jose_jwk:shared_secret/2 function (exposed as JOSE.JWK.shared_secret/2). The vulnerability occurs because the fallback clause re-invokes itself with identical arguments when pr...

CVE-2026-65628 Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types

josejwk:sharedsecret/2 exposed in Elixir as JOSE.JWK.sharedsecret/2 derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type kty module, and its fallback clause re-invokes itself as sharedsecretfromYourJWK, fromMyJWK. Because from/...

CLSA-2026-1780063601 gcc: Fix of 2 CVEs

CVE-2021-46195: fix infinite recursion in libiberty rust demangler...

CVE-2026-114095

A flaw was found in dulwich. When resolving Git packfile objects, the delta offset calculation fails to properly validate self-referential entries. An attacker can exploit this issue by providing a specially crafted Git packfile during repository operations such as clone or fetch, triggering...

Infinite loop

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Infinite loop via cyclic tree structures in TreeObject.removechild and PdfWriter.findoutlineitem, where a PDF containing a...

SUSE CVE-2026-114095

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

AZL-109893 CVE-2026-114095 affecting package python-dulwich 0.21.7-6

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

CVE-2026-114095

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

DEBIAN-CVE-2026-114095

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...