CVE-2026-54183

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

EUVD-2026-57310

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

CVE-2026-54183

Apache Airflow contains a vulnerability where the secrets masker fails to hide sensitive values in the Variables UI when those values are nested within lists, tuples, or sets beyond a specific recursion-depth limit. This is an incomplete-fix follow-up to CVE-2026-42358 . While the exposure is lim...

PT-2026-71138

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The secrets masker in the UI fails to hide values stored under sensitive key names when they are nested inside a list, tuple, or set beyond the recursion-depth limit. This results in Airflow...

CVE-2026-62296 HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner and parseElement, raisi...

Security Bulletin: IBM watsonx.data integration (Data Observability) is affected by a denial-of-service (DoS) due to protobuf

Summary IBM watsonx.data integration Data Observability is vulnerable to protobuf-3.20.3-cp39-cp39-manylinux25x8664.manylinux1x8664.whl CVE-2026-0994. A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed...

SUSE CVE-2026-63891

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into tbpropertyparsedir with no depth counter. A crafted peer that chains DIRECTORY...

CVE-2026-64194 Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack at least with...

Duplicate Advisory: SurrealDB has Denial of Service in JSON parser due to nested objects

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q729-696q-g9pq. This link is maintained to preserve external references. Original Description SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when...

CVE-2026-63759

SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process...

CVE-2026-63760

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the...

CVE-2026-63759

SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process...

CVE-2026-63760

SurrealDB prior to 3.1.0 fails to enforce recursion depth limits in its value/JSON parsers when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON to the WebSocket /rpc endpoint to exhaust server memory and crash the process. Remediation deta...

CVE-2026-63759

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-63759 SurrealDB before 3.1.0 Denial of Service nested type annotations

SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process...

CVE-2026-63759 SurrealDB before 3.1.0 Denial of Service nested type annotations

SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process...

CVE-2026-63760

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the...

CVE-2026-63760 SurrealDB before 3.1.0 Denial of Service via JSON Parser

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the...

PT-2026-61576

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0 Description The value and JSON parser fails to enforce the configured recursion depth limit when processing nested braces, brackets, or parentheses. Unauthenticated attackers can exploit this by sending deeply...

PT-2026-61575

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0 Description The type/kind parser does not enforce recursion depth limits when processing nested type annotations. This allows authenticated attackers to send queries containing deeply nested type annotations,...