kernel: net: openvswitch: reject oversized nested action attrs

A flaw was found in Open vSwitch in the Linux kernel. Improper handling of oversized nested action attributes can lead to a truncated length field, which could be exploited by a local attacker to alter kernel memory. This alteration might result in the disclosure of sensitive information or a loc...

kernel: net: openvswitch: reject oversized nested action attrs

A flaw was found in Open vSwitch in the Linux kernel. Improper handling of oversized nested action attributes can lead to a truncated length field, which could be exploited by a local attacker to alter kernel memory. This alteration might result in the disclosure of sensitive information or a loc...

kernel: net: openvswitch: reject oversized nested action attrs

A flaw was found in Open vSwitch in the Linux kernel. Improper handling of oversized nested action attributes can lead to a truncated length field, which could be exploited by a local attacker to alter kernel memory. This alteration might result in the disclosure of sensitive information or a loc...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is active and KVM uses a separate MSR bitmap to run L2. If AVIC is ful...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: KVM: nVMX: Moving the consistency check between vTPR and TPR Threshold to “normal” checks Moving the off-by-default consistency check for vmcs12.tprthreshold versus the virtual APIC vTPR to the “normal” control checks is...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: removed the spurious WARN message when writing to ZCREL2. It is entirely possible for a guest to write to the ZCREL2 sysreg alias while in a nested context. This is expected if FEATNV2 is advertised to the L1...

PT-2026-81027

Name of the Vulnerable Software and Affected Versions Mistune versions 3.3.0 through 3.3.2 Description This issue allows a Denial of Service DoS through deeply nested tokens. When rendering HTML, consecutive asterisk characters can create deeply nested emphasis tokens. The recursive rendering...

CVE-2026-76098: Uncontrolled Recursion

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.rendertoken can excee...

Duplicate Advisory: Uncontrolled recursion DoS in JustHTML() via deeply nested HTML

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v7cf-c9rm-wm3j. This link is maintained to preserve external references. Original Description justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During...

GHSA-892M-GCQ8-2468 Duplicate Advisory: Uncontrolled recursion DoS in JustHTML() via deeply nested HTML

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v7cf-c9rm-wm3j. This link is maintained to preserve external references. Original Description justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During...

CVE-2026-9769 justhtml before 1.10.0 Denial of Service via deeply nested HTML

justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML construction, TreeBuilder.finish unconditionally calls populateselectedcontent, which recursively traverses the DOM tree via findelements/findelement without a depth bound...

CVE-2026-9769 justhtml before 1.10.0 Denial of Service via deeply nested HTML

justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML construction, TreeBuilder.finish unconditionally calls populateselectedcontent, which recursively traverses the DOM tree via findelements/findelement without a depth bound...

CVE-2026-9769

justhtml (Python HTML parser) through version 1.9.1 is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_ele...

CVE-2026-9769 justhtml before 1.10.0 Denial of Service via deeply nested HTML

justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML construction, TreeBuilder.finish unconditionally calls populateselectedcontent, which recursively traverses the DOM tree via findelements/findelement without a depth bound...

GHSA-CV2G-M8RR-888C Duplicate Advisory: Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rf74-v2fm-23pw. This link is maintained to preserve external references. Original Description NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows...

Duplicate Advisory: Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rf74-v2fm-23pw. This link is maintained to preserve external references. Original Description NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows...

PYSEC-2026-3724

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

PYSEC-0000-CVE-2026-66393

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

CVE-2026-66393

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

EUVD-2026-64310

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...