com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

CVE-2017-12635

CVE-2017-12635 Case study and PoC of CVE-2017-12635 Apache CouchDB 1.7.0 / 2.x 2.1.1 - Remote Privilege Escalation Presentation CouchDB Apache CouchDB is a document-oriented NoSQL database, implemented in Erlang. CouchDB uses multiple formats and protocols to store, transfer, and process it's dat...

EUVD-2026-110481

flatcc through 0.6.4 contains an out-of-bounds read vulnerability in flatccjsonparsernumber that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing...

CVE-2026-116733

flatcc through 0.6.4 contains an out-of-bounds read vulnerability in flatccjsonparsernumber that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing...

CVE-2026-116733 flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number

flatcc through 0.6.4 contains an out-of-bounds read vulnerability in flatccjsonparsernumber that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing...

CVE-2026-116733

The flatcc library, versions through 0.6.4 , is vulnerable to an out-of-bounds read in the flatcc_json_parser_number function. Attackers can trigger this by providing untrusted JSON containing numbers that end with a decimal point. This allows the parser to read past the input buffer, potentiall...

PT-2026-125482

Name of the Vulnerable Software and Affected Versions flatcc versions prior to 0.6.5 Description An out-of-bounds read occurs in the flatcc json parser number function when processing numbers that end with a decimal point. An attacker can provide untrusted JSON data that terminates immediately...

CLEANSTART-2026-LD68799 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

Security vulnerability affects the sonarqube package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...

CVE-2026-114136

A flaw was found in Django REST framework. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by exhausting server memory. The issue occurs because the JSON parser accepts arbitrary client-supplied charset encodings, including decompression codecs, rathe...

CVE-2026-95117

A flaw was found in jsmn. A remote attacker can exploit a buffer overflow by providing specially crafted JSON input to the parser. Successful exploitation causes the application to crash, resulting in a Denial of Service DoS...

Linux Distros Unpatched Vulnerability : CVE-2026-95115

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser CVE-2026-95115 Note...

CVE-2026-110681

A flaw was found in perl-Cpanel-JSON-XS. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a new thread is created, these pointers are copied into the new interpreter unchanged. As a result, the child's parser uses, and later frees, scalars that...

CVE-2026-110675

A flaw was found in perl-Cpanel-JSON-XS. When the utf8 and allowbarekey configurations which are enabled by the relaxed setting are active, a quoted key is correctly validated as UTF-8, but a bare key's bytes are stored as a UTF-8 flagged string without any validation. Consequently, malformed...

CVE-2026-112021 snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()

snac2 before 2.93 contains a heap-based buffer overflow vulnerability in xsjsonloadlexer that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to...

CVE-2026-112021

The snac2 software prior to version 2.93 is vulnerable to a heap-based buffer overflow in the _xs_json_load_lexer() function. An unauthenticated remote attacker can trigger this by sending a crafted application/activity+json POST request to activitypub_post_handler(). The vulnerability occurs bec...

CVE-2026-112021 snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()

snac2 before 2.93 contains a heap-based buffer overflow vulnerability in xsjsonloadlexer that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. Attackers can send a single crafted application/activity+json POST to...

Security Bulletin: IBM Engineering Lifecycle Optimization - Engineering Publishing affected by a Denial of Service vulnerability in Jackson Core (CVE-2026-18401)

Summary A security vulnerability CVE-2026-18401 has been identified in the Jackson Core library used by IBM Engineering Lifecycle Optimization - Engineering Publishing. The non-blocking async JSON parser fails to enforce the maxNumberLength constraint default: 1,000 characters defined in...

Security Bulletin: IBM Disconnected Log Collector contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Disconnected Log Collector has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-27727 DESCRIPTION: mchange-commons-java, a...