Elasticsearch 5.x < 8.19.19 / 9.3.x < 9.3.8 / 9.4.x < 9.4.4 DoS (ESA-2026-75)

The version of Elasticsearch installed on the remote host is 5.x prior to 8.19.19, or 9.3.x prior to 9.3.8, or 9.4.x prior to 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-75 advisory. - A flaw in Elasticsearch allows an authenticated user with the privileges...

cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader

cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader...

PT-2026-79091

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 Description The 'move plugin' endpoint in 'cms/admin/placeholderadmin.py' fails to validate the plugin parent value, allowing a staff user with plugin-change permissions to assign a plugin's own identifier or...

CVE-2026-17121: Uncontrolled Resource Consumption

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled recursion...

Uncontrolled Recursion

Overview org.springframework.ai:spring-ai-pdf-document-reader is a Spring AI PDF document reader Affected versions of this package are vulnerable to Uncontrolled Recursion in an ingestion thread. An attacker can cause a denial of service by submitting a PDF with a deeply nested or cyclic table of...

MiracleLinux 9 : p11-kit-0.26.4-1.el9_8 (AXSA:2026-1590:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1590:02 advisory. p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing CVE-2026-13757 Tenable has extracted the preceding description block directly from...

RHEL 9 : postgresql (RHSA-2026:57633)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57633 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Denial of Service via...

CVE-2026-16824

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to unbounded recursion...

EUVD-2026-62707

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to unbounded recursion...

CVE-2026-16824 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to unbounded recursion...

CVE-2026-16824

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 are vulnerable to unbounded recursion allowing a remote, unauthenticated attacker to cause denial of service (CVSS 7.5, HIGH). IBM's support page is the primary reference. No exploitation details or fix versions are provided in the documents.

CVE-2026-74260

A flaw was found in the Linux kernel's netfilter component, specifically within the nfdupnetdev module. This vulnerability arises from an imbalanced decrementation of recursion counters when network packets are transmitted, particularly during a possible migration to a different CPU. This imprope...

BIT-GOLANG-2026-56859 Add recursion depth guard during decode in encoding/xml

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

BIT-GOLANG-2026-33818 Enforce maximum recursion depth in encoding/asn1

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CVE-2026-74382

A flaw was found in the Linux kernel's clsbpf component, which handles traffic control filtering. A local attacker could exploit this vulnerability by triggering a specific sequence of failures during an offload rollback operation. This leads to an unbounded recursion, causing a stack overflow an...

Uncontrolled Recursion

com.rabbitmq, amqp-client is vulnerable to Uncontrolled Recursion. The vulnerability is due to ValueReader.readTable and ValueReader.readArray recursively processing nested AMQP table and array values without a nesting-depth limit, which allows an attacker controlling the AMQP server or network...

SUSE-SU-2026:23300-1 Security update for go1.25

This update for go1.25 fixes the following issues: Update to go1.25.13 released 2026-08-13, bsc1244485. Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested, recursive structures bsc1275034. - CVE-2026-39821:...

BIT-DJANGO-2026-15830 Potential denial-of-service vulnerability via nested geometry collections

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

BIT-ELASTICSEARCH-2026-72686 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation...

BIT-ELASTICSEARCH-2026-72683 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate to submit a request that causes a self-referential data structure to be created. Whe...