CVE-2026-119187

The Forge (also known as node-forge ) JavaScript TLS implementation is vulnerable to a Denial of Service (DoS) via call stack exhaustion. In versions prior to 1.4.1 , the forge.tls.createConnection() function processes received TLS records recursively, consuming one JavaScript stack frame per rec...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

CVE-2026-34308

CVE-2026-34308: MySQL Server JSON component denial of service Official vendor bulletin: Oracle Critical Patch Update Advisory — April 2026. Summary from published CVE Vulnerability in Oracle MySQL Server component: Server: JSON. Supported affected versions: 8.0.0–8.0.45 , 8.4.0–8.4.8 , and...

Damn_Vulnerable_C_Program

Note: file name has been changed from imgRead.c to dvcp.c, if you are watching videos, you will see imgRead.c but in github repo you will see dvcp.c, please use correct filename. Damn Vulnerable C ProgramDVCP My YouTube Channel: https://www.youtube.com/user/MrHardik05/featured?viewas=subscriber...

CVE-2021-42697

Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments. References MITRE Akka blog Arbitrary nesting of...

CVE-2026-40345

deepmerge-ts mergeleft.self, right.self - mergeleft.self, right.self - mergeleft.self, right.self...

katana

Katana A BootROM exploit for Qualcomm devices released within 2016 til 2019. Brief Explanation of the Exploit With the MSM8998 Nazgul SoC, the command 0x13 SAHARARESETSTATEMACHINEID was added. The command called into bootsaharaentry, which is supposed to reinitialize Sahara. The flaw is that each...

Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process

Description Yaml\Parser::lexInlineStructure recursed through lexInlineMapping and lexInlineSequence for every and of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as ...,...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2025-46206

There is a denial of service vulnerability in MuPDF 1.25.6 and earlier versions. When an attacker runs the "mutool clean poc /dev/null" command, the program will fall into an infinite recursion between the stripoutlines and stripoutline functions in pdf-clean-file.c until the stack is exhausted...

CLEANSTART-2026-AW90620 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

CVE-2026-56859 affects multiple packages. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. See references for individual vulnerability details...

CLEANSTART-2026-IE76702 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

CVE-2026-33818 affects multiple packages. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in brace-expansion

Summary SPSS Collaboration and Deployment Services is affected by vulnerabilities in brace-expansion. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-102276 DESCRIPTION: The brace-expansion library generates arbitrary strings containing a common prefix and...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

Amazon Linux 2023 : amazon-efs-utils (ALAS2023-2026-3333)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3333 advisory. Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations...

Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-3297)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3297 advisory. The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in...

Fedora 44 : php-pecl-mongodb2 (2026-4a5aaed9f5)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4a5aaed9f5 advisory. Version 2.1.12 Release Highlights - PHPC-276: Prevent stack exhaustion when decoding deeply nested BSON - PHPC-276: Enforce the decode nesting limit...

Fedora 43 : php-pecl-mongodb2 (2026-1ed9f02b1e)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1ed9f02b1e advisory. Version 2.1.12 Release Highlights - PHPC-276: Prevent stack exhaustion when decoding deeply nested BSON - PHPC-276: Enforce the decode nesting limit...

Important: amazon-efs-utils

Issue Overview: Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted b...