The vulnerabilities of the jvp_string_append() and jvp_string_copy_replace_bad() functions, which are utilities for processing JSON files in jq, allow a malicious actor to cause service interruptions.

The vulnerabilities of the jvpstringappend and jvpstringcopyreplacebad functions, which are used to process JSON files in jq, are related to integer overflow. Exploiting these vulnerabilities could allow an attacker to cause a service failure by sending a specially crafted request...

AZL-82928 CVE-2026-33948 affecting package jq for versions less than 1.7.1-5

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen to determine buffer length instead of the actual byte...

Logging of Excessive Data

Overview pocketmine/pocketmine-mp is a highly customisable, open source server software for Minecraft: Bedrock Edition written in PHP Affected versions of this package are vulnerable to Logging of Excessive Data through the processing of unexpected properties in the clientData of the LoginPacket...

GHSA-H6RJ-3M53-887H PocketMine-MP: LogDoS by large complex unknown property logging in clientData in LoginPacket

Impact Attackers can put large and/or complex structures as a value to an unknown property in the clientData JWT body in the Minecraft LoginPacket, causing the server to generate very long log messages. Additionally, the property name is logged without any length limitations or sanitization, whic...

The vulnerability of the JSON data processing library Json-smart, related to uncontrolled recursion, allows attackers to trigger a service failure.

The vulnerability of the JSON data processing library Json-smart is related to uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor to cause service failures...

EGroupware has SQL Injection in Nextmatch Filter Processing

Summary Critical Authenticated SQL Injection in Nextmatch Widget Filter Processing A critical SQL Injection vulnerability exists in the core components of EGroupware, specifically in the Nextmatch filter processing. The flaw allows authenticated attackers to inject arbitrary SQL commands into the...

CBL Mariner 2.0 Security Update: CBL-Mariner Releases (CVE-2025-11230)

The version of CBL-Mariner Releases installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-11230 advisory. - Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial...

CVE-2025-66786

OpenAirInterface CN5G AMF=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack...

PT-2026-1863

Name of the Vulnerable Software and Affected Versions OpenAirInterface CN5G AMF versions through 2.0.1 Description A logical error exists in the processing of JSON format requests. Remote attackers can send malicious JSON data to the AMF's SBI interface, potentially causing a denial-of-service...

CVE-2025-66786

OpenAirInterface CN5G AMF=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack...

CVE-2025-66786

The OpenAirInterface CN5G AMF software (versions

EUVD-2025-202636

NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.60027, Hub M3 4.3.60025, and Camera Hub G3 4.1.90027 in the JSON processing enable denial-of-service attacks through malformed JSON inputs...

CVE-2025-65296: NULL Pointer Dereference

NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.60027, Hub M3 4.3.60025, and Camera Hub G3 4.1.90027 in the JSON processing enable denial-of-service attacks through malformed JSON inputs...

The vulnerability of the software platform’s JSON file processing mechanism, based on Git, allows a violator to trigger a service failure. This vulnerability enables a violator to cause a service failure.

The vulnerability of the software platform’s JSON file processing mechanism, based on Git, for collaborative code development in GitLab CE/EE, is related to unlimited resource distribution. Exploiting this vulnerability allows a malicious actor to cause service failures by sending specially craft...

CVE-2025-12044

Vault and Vault Enterprise “Vault” are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for +HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when processing JSON payloads before applying rate limits. An attacker can cause service disruption by sending specially crafted JSON payloads that bypass rate limiting. Note: This is...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the processing of malicious JSON payloads in the request handling process. An attacker can exhaust system memory and CPU resources by sending specially crafted JSON objects that, when deserialized, consume...

OESA-2025-2365 perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. Security Fixes: JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when...

perl-JSON-XS security update

An update is available for perl-JSON-XS. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This module converts Perl data structures to JSON and vice versa. Its...

RLSA-2025:17162 Moderate: perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. Security Fixes: JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON CVE-2025-40928 For...