RUSTSEC-2026-0187 Stack overflow in lopdf via deeply nested PDF objects

lopdf::Document::loadmem and the other load entry points parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array /X … , on the order of 10,000 levels exhausts the call stack and aborts the process with SIGABRT. Because...

PT-2026-54955

lopdf::Document::load mem and the other load entry points parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array /X … , on the order of 10,000 levels exhausts the call stack and aborts the process with SIGABRT. Because...

Symlink Attack

Overview pydantic-settings is a Settings management using Pydantic Affected versions of this package are vulnerable to Symlink Attack in the NestedSecretsSettingsSource process when secretsnestedsubdir is enabled and a symbolic link inside the configured secrets directory points outside of it. An...

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

Summary NestedSecretsSettingsSource reads secret values from files in a configured secretsdir. When secretsnestedsubdir=True, a directory entry inside secretsdir that is a symbolic link pointing outside secretsdir is followed, so files outside the configured directory are read into settings value...

GHSA-9C83-RR99-VFWJ MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested

PathFilter's deny-list glob patterns are anchored, so .git, .obsidian, and nodemodules were only blocked at the vault root. Nested copies inside the vault e.g. tools/cli/nodemodules/..., tools/somerepo/.git/config, a nested .obsidian/ were fully traversable via isAllowed/isAllowedForListing...

flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key

Summary convert builds the nested tree by using each flat record's id and parent field values directly as object keys, with no guard against proto / constructor / prototype. A record whose parent is the string "proto" makes tempparent resolve to Object.prototype, and the following initPush...

NPM: flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key

NPM: flat-to-nested: Prototype pollution in flat-to-nested convert via proto parent/id key vulnerability discovered by ? in WordPress Npm flat-to-nested versions = 1.1.1...

@chaibuilder/sdk (>=0.1.0, <=1.2.19), @coderrental/csp-categorytree (>=1.1.0, <=1.1.7) +2 more potentially affected by CVE-2026-55091 via flat-to-nested (>=1.1.0, <=1.1.1)

flat-to-nested NPM version =1.1.0, =0.1.0, =1.1.0, =1.0.17, =1.0.18 - flow-dg-category-module 0.0.0 Source cves: CVE-2026-55091 Source advisory: OSV:GHSA-HP36-V28F-W3R4...

@chaibuilder/sdk (>=0.1.0, <=1.2.19), @coderrental/csp-categorytree (>=1.1.0, <=1.1.7) +2 more potentially affected by CVE-2026-55091 via flat-to-nested (>=1.1.0, <=1.1.1)

flat-to-nested NPM version =1.1.0, =0.1.0, =1.1.0, =1.0.17, =1.0.18 - flow-dg-category-module 0.0.0 Source cves: CVE-2026-55091 Source advisory: SNYK:JS-FLATTONESTED-17817904...

GHSA-HP36-V28F-W3R4 flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key

Summary convert builds the nested tree by using each flat record's id and parent field values directly as object keys, with no guard against proto / constructor / prototype. A record whose parent is the string "proto" makes tempparent resolve to Object.prototype, and the following initPush...

Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input

Summary Oj::Doceachchild, when invoked recursively over a deeply nested JSON document, overflows a fixed-size stack buffer and aborts the process. This is a denial of service reachable from untrusted JSON. Details Two-step chain in ext/oj/fast.c: 1. doceachchild line 1501 increments doc-where pas...

GHSA-3M6Q-JJ5J-38C9 Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input

Summary Oj::Doceachchild, when invoked recursively over a deeply nested JSON document, overflows a fixed-size stack buffer and aborts the process. This is a denial of service reachable from untrusted JSON. Details Two-step chain in ext/oj/fast.c: 1. doceachchild line 1501 increments doc-where pas...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write through recursive calls to the eachchild function when processing deeply nested input. An attacker can cause the process to crash and trigger a denial of service by supplying a specially crafted, deeply nested JSON...

GHSA-98M9-HRRM-R99R Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth. A crafted query string such as: text axxxx...x=1 causes Faraday to build a deeply nested Ruby Hash structure. The internal dehash...

Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth. A crafted query string such as: text axxxx...x=1 causes Faraday to build a deeply nested Ruby Hash structure. The internal dehash...

GHSA-MQQ5-J7W8-2HGH AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished content

Unauthenticated nested page API leaks restricted & unpublished content - Location: app/controllers/alchemy/api/pagescontroller.rb:28 Api::PagesControllernested - Affected version: Alchemy CMS 8.3.0.dev Rails 8.1.3 Description The unauthenticated GET /api/pages/nested endpoint returns the full pag...

GHSA-CGXM-VR2F-6FJ8 parse-server: Denial of service via exponential-time processing of deeply nested query operators

Impact Parse Server is vulnerable to denial of service. A remote attacker can send a single, small query 1 KB containing deeply nested query condition operators. Parse Server processes the nested structure with exponential time complexity, which blocks the Node.js event loop and makes the server...

Inefficient Algorithmic Complexity

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the query-depth processing in validateQueryDepth and...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Raise UD if the unhandled VMMCALL is not intercepted by L1. If L2 is active, and L1 does not want to intercept VMMCALL, and nestedsvml2tlbflush is enabled, and the hypercall is something other than one of the supported...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: KVM: x86 – Check for nEPT/nNPT in slow flush hypercalls The check for isguestmodevcpus is incorrect, because the translatenestedgpa function is only valid if a L2 guest is running with nested EPT/NPT enabled. Instead, use the...