GHSA-GGR8-5VV4-36MX DeepmergeTS has stack exhaustion when merging recursive object graphs

Summary deepmerge and deepmergeInto can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws RangeError: Maximum call stack size exceeded. Details Record merging is implemented...

DeepmergeTS has stack exhaustion when merging recursive object graphs

Summary deepmerge and deepmergeInto can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws RangeError: Maximum call stack size exceeded. Details Record merging is implemented...

NPM: DeepmergeTS has stack exhaustion when merging recursive object graphs

NPM: DeepmergeTS has stack exhaustion when merging recursive object graphs vulnerability discovered by ? in WordPress Npm deepmerge-ts versions 8.0.0...

Uncontrolled Recursion

Overview deepmerge-ts is a Deeply merge 2 or more objects respecting type information. Affected versions of this package are vulnerable to Uncontrolled Recursion via the deepmerge and deepmergeInto functions. An attacker can cause a process crash or denial of service by supplying crafted recursiv...

BIT-PHP-MIN-2026-7260 Stack overflow in phar with circular symlinks

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

BIT-PHP-2026-7260 Stack overflow in phar with circular symlinks

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

PT-2026-73368

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

PT-2026-73422

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

SUSE CVE-2026-33818

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

SUSE CVE-2026-56859

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

CVE-2026-33818

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

CVE-2026-56859

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-19617

A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the...

AZL-96698 CVE-2026-19617 affecting package lvm2 2.03.23-1

A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the...

DEBIAN-CVE-2026-19617

A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the...

CVE-2026-19617

A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the...

UBUNTU-CVE-2026-19617

A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the...

CVE-2026-19617 Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser

A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the...

CVE-2026-19617

A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the...

CVE-2026-19617 Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser

A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the...