523 matches found
CVE-2017-12635
CVE-2017-12635 Case study and PoC of CVE-2017-12635 Apache CouchDB 1.7.0 / 2.x 2.1.1 - Remote Privilege Escalation Presentation CouchDB Apache CouchDB is a document-oriented NoSQL database, implemented in Erlang. CouchDB uses multiple formats and protocols to store, transfer, and process it's dat...
CVE-2026-114136
A flaw was found in Django REST framework. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by exhausting server memory. The issue occurs because the JSON parser accepts arbitrary client-supplied charset encodings, including decompression codecs, rathe...
CVE-2026-95117
A flaw was found in jsmn. A remote attacker can exploit a buffer overflow by providing specially crafted JSON input to the parser. Successful exploitation causes the application to crash, resulting in a Denial of Service DoS...
CVE-2026-110681
A flaw was found in perl-Cpanel-JSON-XS. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a new thread is created, these pointers are copied into the new interpreter unchanged. As a result, the child's parser uses, and later frees, scalars that...
CVE-2026-110675
A flaw was found in perl-Cpanel-JSON-XS. When the utf8 and allowbarekey configurations which are enabled by the relaxed setting are active, a quoted key is correctly validated as UTF-8, but a bare key's bytes are stored as a UTF-8 flagged string without any validation. Consequently, malformed...
CVE-2026-112021 snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()
snac2 before 2.93 contains a heap-based buffer overflow vulnerability in xsjsonloadlexer that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to...
CVE-2026-112021
The snac2 software prior to version 2.93 is vulnerable to a heap-based buffer overflow in the _xs_json_load_lexer() function. An unauthenticated remote attacker can trigger this by sending a crafted application/activity+json POST request to activitypub_post_handler(). The vulnerability occurs bec...
Security Bulletin: IBM Engineering Lifecycle Optimization - Engineering Publishing affected by a Denial of Service vulnerability in Jackson Core (CVE-2026-18401)
Summary A security vulnerability CVE-2026-18401 has been identified in the Jackson Core library used by IBM Engineering Lifecycle Optimization - Engineering Publishing. The non-blocking async JSON parser fails to enforce the maxNumberLength constraint default: 1,000 characters defined in...
com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...
DEBIAN-CVE-2026-95115
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser...
CVE-2026-95115
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser...
CVE-2026-95115
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser...
UBUNTU-CVE-2026-95115
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser...
CVE-2026-95115: Out-of-bounds Write
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser...
CVE-2026-95115
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser...
CVE-2026-95115
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser...
CVE-2026-95115
A buffer overflow vulnerability exists in the libwebsockets library (main 106d542c) within the LEJP JSON parser . This flaw allows a remote attacker to trigger a denial of service (DoS) condition. While the vulnerability is confirmed to be exploitable via a proof-of-concept, specific exploit link...
CLEANSTART-2026-HQ66440 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)
Security vulnerability affects the apache-nifi package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...
CVE-2026-44037
A flaw was found in dcmtk. An attacker can cause a Denial of Service DoS by providing a crafted DICOM Digital Imaging and Communications in Medicine JSON document containing deeply nested sequence values. Processing this input triggers uncontrolled recursion in the JSON parser, causing stack memo...
Security Bulletin: Multiple Vulnerabilities affects IBM Data Studio Client 4.2.3
Summary Security Fix of multiple Vulnerabilities of IBM Data Studio Client 4.2.3. The vulnerabilities have been addressed in 4.2.3 version. Hence, IBM strongly recommends upgrading to 4.2.3. Vulnerability Details CVEID:CVE-2026-18401 DESCRIPTION: The non-blocking asynchronous JSON parser in...