11 matches found
CVE-2026-116011
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating...
CVE-2026-116011
Crow versions prior to 1.3.4 are susceptible to a Denial of Service (DoS) vulnerability due to uncontrolled recursion in the crow::json::load() function. Remote unauthenticated attackers can crash the server by submitting a request body containing thousands of deeply nested JSON objects . This ac...
EUVD-2026-109269
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating...
CVE-2026-116011 Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating...
CVE-2026-116011 Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating...
pgAdmin Cross-Site Scripting Vulnerability
pgAdmin is an open source management and development platform for the open source database PostgreSQL. A cross-site scripting vulnerability exists in pgAdmin 8.5 and earlier versions, which stems from a cross-site scripting vulnerability in the /settings/store endpoint that responds to a json loa...
Ruby on Rails: Unexpected deserialization in Kredis
Unexpected classes could be deserialized in Kredis due to the use of JSON.load, potentially leading to security vulnerabilities...
Arbitrary Command Execution
jmespath is vulnerable to arbitrary command execution. An attacker is able to inject and execute arbitrary commands due to the unsafe usage of JSON.load where JSON.parse is preferable...
DEBIAN-CVE-2022-32511
jmespath.rb aka JMESPath for Ruby before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable...
