CVE-2026-71429 stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token...

CVE-2026-71429 stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token...

CVE-2026-71429 stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token...

SUSE CVE-2026-66393

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

CVE-2026-66393

A flaw was found in NLTK. A remote attacker can exploit an unbounded recursion vulnerability in the JSONTaggedDecoder.decodeobj function by supplying deeply nested JSON structures. This can cause the Python process to crash, leading to a denial of service. Mitigation To mitigate this vulnerabilit...

Duplicate Advisory: Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rf74-v2fm-23pw. This link is maintained to preserve external references. Original Description NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows...

GHSA-CV2G-M8RR-888C Duplicate Advisory: Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rf74-v2fm-23pw. This link is maintained to preserve external references. Original Description NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows...

CVE-2026-66393

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

PYSEC-0000-CVE-2026-66393

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

PYSEC-2026-3724

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

CVE-2026-66393

NLTK versions before 3.9.4 are affected by an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() . An attacker can supply a deeply nested JSON structure that exceeds Python's recursion limit, triggering an unhandled RecursionError that crashes the process, resulting in denial of ...

EUVD-2026-64310

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

CVE-2026-66393 NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

CVE-2026-66393 NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

Summary An unauthenticated POST to any OpenAPI-validated endpoint, including the anonymous POST /edge/validate and POST /edge/issue-token, crashes the entire Unleash server with one request body of deeply-nested JSON. When request-body validation fails, Unleash builds the error message by calling...

GHSA-R5PQ-6CHH-J3XP Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

Summary An unauthenticated POST to any OpenAPI-validated endpoint, including the anonymous POST /edge/validate and POST /edge/issue-token, crashes the entire Unleash server with one request body of deeply-nested JSON. When request-body validation fails, Unleash builds the error message by calling...

EUVD-2026-64041

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding...

CVE-2026-63462 Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding...

PT-2026-79422

Name of the Vulnerable Software and Affected Versions Unleash versions prior to 7.5.2 Unleash versions prior to 7.6.5 Unleash versions prior to 8.0.2 Description An unauthenticated attacker can cause a complete service outage by sending a deeply nested JSON value approximately 10 KB to...

PT-2026-80307

Summary An unauthenticated POST to any OpenAPI-validated endpoint, including the anonymous POST /edge/validate and POST /edge/issue-token, crashes the entire Unleash server with one request body of deeply-nested JSON. When request-body validation fails, Unleash builds the error message by calling...