commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input

A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...

OESA-2026-3328 apr-util security update

The mission of the Apache Portable Runtime APR project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of...

OESA-2026-3327 apr-util security update

The mission of the Apache Portable Runtime APR project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of...

OESA-2026-3326 apr-util security update

The mission of the Apache Portable Runtime APR project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of...

JLSEC-2026-1302

libcroco through 0.6.13 has excessive recursion in crparserparseanycore in cr-parser.c, leading to stack consumption...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-78)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no...

Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-133)

Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service Description: Uncontrolled Recursion CWE-674 in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation CAPEC-130. The matcher used to resolve wildcard patterns agains...

Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-75)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint to submit a request that causes a self-referential data structure to be created. When a specific...

CVE-2026-52057

mgderfindoid unbounded recursion on constructed DER tags...

PT-2026-76031

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

PT-2026-80544

libcroco through 0.6.13 has excessive recursion in cr parser parse any core in cr-parser.c, leading to stack consumption...

CVE-2026-72683: Uncontrolled Recursion

A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate to submit a request that causes a self-referential data structure to be created. Whe...

CVE-2026-72679: Uncontrolled Recursion

Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch node process and...

CVE-2026-72686: Uncontrolled Recursion

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation...

PT-2026-71762

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Uncontrolled Recursion occurs when a program continues to call a function without a proper termination condition. In this case, an authenticated user with read privileges on a single...

PT-2026-71792

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An authenticated user with sufficient privileges can trigger a denial of service by sending a request to the 'simulate pipeline' API endpoint. This action creates a self-referential dat...

ROS-20260813-73-0048

The vulnerability in uriparser is related to an uncontrolled recursion. Exploiting this vulnerability can allow attackers to cause service failures...

CVE-2026-72636: Uncontrolled Recursion

Uncontrolled Recursion CWE-674 in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation CAPEC-130. The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of mat...

CVE-2026-72638: Uncontrolled Recursion

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that i...

CVE-2026-72647: Uncontrolled Recursion

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without...