No title provided

A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a...

PHP 8.2.x < 8.2.33 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.2.33. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.33 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8....

PHP 8.5.x < 8.5.9 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.5.9. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.5.9 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2...

The vulnerabilities of the functions cJSONUtils_ApplyPatches() and cJSONUtils_ApplyPatchesCaseSensitive() in the C language library for working with JSON objects in cJSON, which allow a hacker to trigger a service failure.

The vulnerabilities of the functions cJSONUtilsApplyPatches and cJSONUtilsApplyPatchesCaseSensitive in the C language JSON object handling library are related to uncontrolled recursion. Exploiting these vulnerabilities could allow an attacker to cause service failures...

Apache Traffic Server resource management error vulnerability (CNVD-2026-30701)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is a resource management vulnerability in Apache Traffic Server, which stems from the ESI plugin’s failure to properly handle recursive requests. Attackers can exploit...

CVE-2026-18140: Uncontrolled Recursion

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service process abort via stack exhaustion via...

PHP 8.4.x < 8.4.24 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.4.24. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.4.24 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8....

PHP 8.3.x < 8.3.33 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.3.33. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.33 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8....

PT-2026-76326

Summary Stack overflow via infinite recursion in MSL Magick Scripting Language command when writing to MSL format. Version - ImageMagick 7.x tested on current main branch - Commit: HEAD - Requires: libxml2 support for MSL parsing Steps to Reproduce Method 1: Using ImageMagick directly bash magick...

PT-2026-66566

Name of the Vulnerable Software and Affected Versions aws-smithy-json versions prior to 0.62.7 Description Uncontrolled recursion occurs in the unknown-key skip path of the runtime crate, which is invoked by the smithy-rs code generator from every generated struct deserializer. This allows remote...

CVE-2026-7260: Stack-based Buffer Overflow

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

PT-2026-66463

Name of the Vulnerable Software and Affected Versions PHP versions 8.2.0 through 8.2.32 PHP versions 8.3.0 through 8.3.32 PHP versions 8.4.0 through 8.4.23 PHP versions 8.5.0 through 8.5.8 Description Circular symbolic links in phar archives can cause unbounded recursion, which exhausts the C sta...

K000162286: BIND vulnerability CVE-2026-1519

Security Advisory Description If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive...

axios: axios: Denial of Service via uncontrolled recursion in form data processing

A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data...

CVE-2026-67194

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser allocsearchkey in searchinfo.C recursively descends on nested parenthesized groups through a mutual...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive process. An attacker can cause stack exhaustion and crash the process by supplying a specially crafted RFC 6902 JSON Patch document...

CVE-2026-54081 veraPDF Parser DoS via PostScript Type 1 Font Programs

veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/pd/font/type1/Type1FontProgram.java and veraPDF-parser/src/main/java/org/verapdf/parser/postscript/PSOperator.java,...

AZL-94410 CVE-2026-67215 affecting package apparmor 3.1.7-1

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...

CVE-2026-67216

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

AZL-94437 CVE-2026-67215 affecting package libglvnd 1.7.0-3

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtilsApplyPatches or cJSONUtilsApplyPatchesCaseSensitive. A patch containing add and copy operations grafts duplicated subtrees to amplify document...