encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

CLEANSTART-2026-RH13168 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Multiple security vulnerabilities affect the go-discover package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details...

PT-2026-94302

Name of the Vulnerable Software and Affected Versions google-protobuf affected versions not specified Description The software contains an unbounded recursion issue when parsing unknown protobuf group fields. An attacker can send a crafted payload consisting of deeply nested START GROUP wire byte...

perl-Net-DNS security update

1.29-6.1 - Fix CVE-2026-81928: Unbounded recursion when re-encoding message with misplaced TSIG - Resolves: RHEL-256275...

perl-Net-DNS security update

1.15-2 - Fix unbounded recursion in TSIG record processing CVE-2026-81928 - Resolves: RHEL-256266 1.15 - Resolves rhbz1544065 Update to 1.15 - Maintenance only 1.14-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora28MassRebuild 1.14-1 - Updated to 1.14 1.13-1 - Updated to 1.13 1.12-1 - Update...

Important: perl-Net-DNS security update

The perl-Net-DNS package contains a collection of Perl modules that act as a Domain Name System DNS resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of the gethostbyname and gethostbyaddr routines. Security Fixes: perl-Net-DNS: Net::DNS: Denial of Service...

CVE-2026-52852: Uncontrolled Recursion

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. org.traccar.api.resource.GroupResource permits...

CVE-2026-93435: Uncontrolled Recursion

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust t...

ALSA-2026:68787 Important: perl-Net-DNS security update

The perl-Net-DNS package contains a collection of Perl modules that act as a Domain Name System DNS resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of the gethostbyname and gethostbyaddr routines. Security Fixes: perl-Net-DNS: Net::DNS: Denial of Service...

CVE-2026-89418: Uncontrolled Recursion

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested STARTGROUP wire bytes to any Node.js service that calls the generated deserializeBinary API, causing a RangeError: Maximum call stack size...

CVE-2026-54451: Uncontrolled Recursion

Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex,...

Important: perl-Net-DNS security update

The perl-Net-DNS package contains a collection of Perl modules that act as a Domain Name System DNS resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of the gethostbyname and gethostbyaddr routines. Security Fixes: perl-Net-DNS: Net::DNS: Denial of Service...

ALSA-2026:68786 Important: perl-Net-DNS security update

The perl-Net-DNS package contains a collection of Perl modules that act as a Domain Name System DNS resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of the gethostbyname and gethostbyaddr routines. Security Fixes: perl-Net-DNS: Net::DNS: Denial of Service...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in axios

Summary IBM Watson Discovery Cartridge affected by vulnerability in axios Vulnerability Details CVEID:CVE-2026-67312 DESCRIPTION: axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON exposed as axios.formToJSON and used internally...

ALPINE-CVE-2026-78301

A malformed zone may contain an NS or DNAME node above its origin, which named treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server e.g., via zone transfer, queries for names inside the configured zone then lose authoritative status and return an...

Security Bulletin: Manage Component uses protobufjs-8.0.1.tgz and utf8-1.1.0.tgz in map-component app which is vulnerable to CVE-2026-44288, CVE-2026-44289, CVE-2026-44290, CVE-2026-44291, CVE-2026-44292, CVE-2026-44293 and CVE-2026-44294

Summary Manage Component uses protobufjs-8.0.1.tgz and utf8-1.1.0.tgz in map-component app which is vulnerable to CVE-2026-44288, CVE-2026-44289, CVE-2026-44290, CVE-2026-44291, CVE-2026-44292, CVE-2026-44293 and CVE-2026-44294. This security bulletin provides details about the vulnerability and...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

Security Bulletin: IBM Sterling Global Availability Mailbox is affected by a vulnerability in bouncy castle 1.84

Summary Bouncy Castle for Java before 1.85 was affected with the CVE-2026-59645 Vulnerability Details CVEID:CVE-2026-59645 DESCRIPTION: In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for...

CVE-2026-19248

A flaw was found in Qt. This vulnerability, specifically an unbounded recursion in the QDomNode destructor during QDomDocument XML parsing, allows a remote attacker to trigger a denial-of-service DoS crash. By processing untrusted XML input, the affected system can become unresponsive, leading to...