CVE-2026-26903-PoC

CVE-2026-26903 PoC Denial-of-service via unbounded recursion in TanStack Query'sreplaceEqualDeep function A single crafted query update with deeply nested objects can freeze the JavaScript thread indefinitely , causing complete application unresponsiveness. No authentication or special permission...

CVE-2026-122053

The Symfony Serializer component ObjectNormalizer treats any attribute name containing . and, from Symfony 6.4, as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their Ignore metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9...

DEBIAN-CVE-2026-122053

The Symfony Serializer component ObjectNormalizer treats any attribute name containing . and, from Symfony 6.4, as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their Ignore metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9...

CVE-2026-122053

The Symfony Serializer component ObjectNormalizer treats any attribute name containing . and, from Symfony 6.4, as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their Ignore metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9...

CVE-2026-117624

A flaw was found in Jenkins. The application fails to consistently enforce restrictions against deserializing certain object types as nested values when those types are designated only for top-level configuration files. An attacker can exploit this flaw by submitting crafted configuration data to...

PT-2026-138136

The Symfony Serializer component ObjectNormalizer treats any attribute name containing . and, from Symfony 6.4, as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their Ignore metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9...

CVE-2026-117624

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potential...

EUVD-2026-112189

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potential...

CVE-2026-117624

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potential...

CVE-2026-117624

Jenkins versions 2.587 and earlier , and LTS 2.580.1 and earlier , are vulnerable to a root element restriction bypass in XStream deserialization (CVE-2026-117624). The software fails to consistently enforce restrictions on deserializing objects marked as storing configurations in independent top...

CVE-2026-117624

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potential...

Jenkins security vulnerabilities

Security vulnerabilities exist in Jenkins versions 2.587 and earlier, as well as LTS 2.580.1 and earlier. These vulnerabilities stem from a lack of consistent restrictions when deserializing object types marked for storing configuration in an independent top-level configuration file. This may all...

PT-2026-128312

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.587 Jenkins LTS versions prior to 2.580.1 Description An issue exists where the software does not consistently enforce restrictions on deserializing objects of types that store their configuration in independent...

CVE-2026-114129

A flaw was found in stream-json. The FlexAssembler component does not enforce a limit on nesting depth when processing JSON documents configured with path filters. By submitting a crafted document with deeply nested objects or arrays, an attacker can trigger excessive key operations that consume...

Astra Linux – vulnerability in jackson-databind

Jackson Databind versions prior to 2.13.0 allow a Java StackOverflow exception and denial of service caused by a large number of deeply nested objects...

Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / etc (crlsa-2024_3061)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243061 advisory. jackson-databind: denial of service via a large depth of nested objects CVE-2020-36518 Tenable has extracted the preceding description block directly from the CIQ...

AlmaLinux 9.2 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.2:CLSA-2025:1760018305)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1760018305 advisory. - jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects...

GHSA-G6GW-C38X-MQFC Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

Summary When parseBody expands dot-separated form field names into nested objects, it does not limit the nesting depth or the total number of objects created. A request body well within a normal size limit can therefore allocate an object graph far larger than the request itself, and concurrent...

PT-2026-88162

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...

CVE-2026-84645

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...