CVE-2026-9769

justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML construction, TreeBuilder.finish unconditionally calls populateselectedcontent, which recursively traverses the DOM tree via findelements/findelement without a depth bound...

CVE-2026-9769 justhtml before 1.10.0 Denial of Service via deeply nested HTML

justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML construction, TreeBuilder.finish unconditionally calls populateselectedcontent, which recursively traverses the DOM tree via findelements/findelement without a depth bound...

CVE-2026-9769

justhtml (Python HTML parser) through version 1.9.1 is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_ele...

CVE-2026-66393

NLTK versions before 3.9.4 are affected by an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() . An attacker can supply a deeply nested JSON structure that exceeds Python's recursion limit, triggering an unhandled RecursionError that crashes the process, resulting in denial of ...

CVE-2026-59927 Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise...

PYSEC-2026-1805 protobuf affected by a JSON recursion depth bypass

A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can...

EulerOS 2.0 SP11 : protobuf (EulerOS-SA-2026-2223)

According to the versions of the protobuf packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypasse...

EulerOS Virtualization 2.12.1 : protobuf (EulerOS-SA-2026-2084)

According to the versions of the protobuf packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit...

CBL Mariner 2.0 Security Update: protobuf (CVE-2025-4565)

The version of protobuf installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-4565 advisory. - Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an...

SUSE SLES15 Security Update : protobuf (SUSE-SU-2025:02310-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:02310-1 advisory. - CVE-2025-4565: Fix parsing of untrusted Protocol Buffers data containing an arbitrary number of recursive groups or messages that can lea...

LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsing

The JSONReader in run-llama/llamaindex versions 0.12.28 is vulnerable to a stack overflow due to uncontrolled recursive JSON parsing. This vulnerability allows attackers to trigger a Denial of Service DoS by submitting deeply nested JSON structures, leading to a RecursionError and crashing...

Denial Of Service (DoS)

Protobuf is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of deeply nested or recursive structures in the Pure-Python backend, leading to a RecursionError...

CVE-2025-4565 Unbounded recursion in Python Protobuf

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashin...

CVE-2025-4565

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashin...

TencentOS Server 4: python-sqlparse (TSSA-2024:0918)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0918 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

K000139698: Python vulnerabilities CVE-2016-5636, CVE-2018-1000802, CVE-2022-48565 and CVE-2023-36632

Security Advisory Description CVE-2016-5636 Integer overflow in the getdata function in zipimport.c in CPython aka Python before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer...

Ubuntu 22.04 LTS / 23.10 / 24.04 LTS : SQL parse vulnerability (USN-6771-1)

The remote Ubuntu 22.04 LTS / 23.10 / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6771-1 advisory. It was discovered that SQL parse incorrectly handled certain nested lists. An attacker could possibly use this issue to cause a denial of...

Duplicate Advisory: sqlparse parsing heavily nested list leads to Denial of Service

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2m57-hf25-phgg. This link is maintained to preserve external references. Original Description Passing a heavily nested list to sqlparse.parse leads to a Denial of Service due to RecursionError...

UBUNTU-CVE-2024-4340

Passing a heavily nested list to sqlparse.parse leads to a Denial of Service due to RecursionError...

CVE-2024-4340 Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

Passing a heavily nested list to sqlparse.parse leads to a Denial of Service due to RecursionError...