PT-2026-79863

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without...

Linux Distros Unpatched Vulnerability : CVE-2026-18140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every...

PT-2026-78591

Name of the Vulnerable Software and Affected Versions IBM AIX version 7.2 IBM AIX version 7.3 IBM PowerVM VIOS version 4.1 Description A remote attacker could cause a denial of service due to unbounded recursion, which occurs when a function calls itself without a proper termination condition,...

CVE-2026-16824: Uncontrolled Resource Consumption

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to unbounded recursion...

PT-2026-79919

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

SUSE SLED15 / SLES15 Security Update : go1.25 (SUSE-SU-2026:3640-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3640-1 advisory. Security issues fixed: - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. -...

CVE-2026-16440: Uncontrolled Recursion

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault...

PT-2026-79859

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that i...

Uncontrolled Resource Consumption

deepmerge-ts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to failure to track visited objects or object pairs during recursive merging, which allows an attacker to provide recursive object graphs that trigger infinite recursion, causing a RangeError and potentially...

RLSA-2026:52395 Important: postgresql security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation CVE-2026-6479 For more details about the security issues, including the impact, a CVSS score, acknowledgments, a...

RLSA-2026:52396 Important: postgresql:12 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation CVE-2026-6479 For more details about the security issues, including the impact, a CVSS score, acknowledgments, a...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in ValueReader table and array parsing. An attacker can crash the client JVM by sending a deeply nested AMQP field value, such as a connection.start frame containing recursively nested tables or arrays. The issue...

DEBIAN-CVE-2026-69220

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively f...

RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS

Summary ValueReader.readTable and readArray recursively call readFieldValue with no depth limit. A malicious AMQP peer can crash the client JVM by sending a deeply nested table structure. Vulnerable Code src/main/java/com/rabbitmq/client/impl/ValueReader.java lines 139-155 and 237-249: java priva...

CVE-2026-72194

A flaw was found in the Linux kernel's NTFS3 filesystem driver. A local attacker could craft a malicious NTFS image with circular index node references. When this filesystem is mounted and a specific file is deleted, it can trigger unbounded recursion in the indxfindbuffer function, leading to a...

CVE-2026-72647

A flaw was found in Elasticsearch. An authenticated user with read privileges on a single index can submit a specially crafted search request. This request, containing deeply nested serialized data, is processed without a depth limit, leading to uncontrolled recursion. This can exhaust the thread...

Security update for go1.26

This update for go1.26 fixes the following issues: Security issues fixed: CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation...

MiracleLinux 8 : postgresql:12 (AXSA:2026-1567:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1567:01 advisory. postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation CVE-2026-6479 Tenable has extracted the preceding description blo...

Amazon Linux 2 : perl-Net-DNS, --advisory ALAS2-2026-3855 (ALAS-2026-3855)

The version of perl-Net-DNS installed on the remote host is prior to 0.72-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3855 advisory. Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains...

CVE-2026-69220: Uncontrolled Recursion

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively f...