Important: jackson

Issue Overview: jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth...

CVE-2026-112186

In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore...

CVE-2026-112186

In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API is vulnerable to denial of service due to improper handling of JSON request bodies. The API reads the JSON body into memory without size limits and performs parsing before authenticating the caller. A remote attacker ca...

EUVD-2026-121410

In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore...

CVE-2026-112186

In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore...

CVE-2026-112186

In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in lz4-java

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in lz4-java. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-106449 DESCRIPTION: yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream...

CVE-2026-112072

vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch Exception handlers and kills the reading thread. A Vault token that can...

EUVD-2026-117399

vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch Exception handlers and kills the reading thread. A Vault token that can...

CVE-2026-112072 vault-java-driver: stored deeply nested JSON kills every thread that reads it

vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch Exception handlers and kills the reading thread. A Vault token that can...

CVE-2026-112072 vault-java-driver: stored deeply nested JSON kills every thread that reads it

vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch Exception handlers and kills the reading thread. A Vault token that can...

CVE-2026-112072

The vault-java-driver (a Java client for HashiCorp Vault) is vulnerable to a StackOverflowError due to an uncontrolled recursion issue in its vendored minimal-json parser . The parser lacks a nesting depth limit, allowing deeply nested JSON values to crash the reading thread. This impact is persi...

org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service...

CVE-2026-120420

A denial-of-service vulnerability was found in the Drools DRL expression parser org.drools:drools-drl-parser. The ANTLR4-generated DRL expression grammar parses parenthesised sub-expressions through mutually recursive descent rules with no limit on nesting depth. When a deeply nested parenthesise...

CVE-2026-119542

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULKREAD permission who can submit a cache query may trigger the...

CVE-2026-119542

A flaw in the Ickle query parser within Infinispan allows a query with deeply nested predicates to cause recursive parsing. This process can exhaust the Java thread stack , resulting in an uncaught StackOverflowError . An authenticated user possessing BULK_READ permissions who is capable of submi...

EUVD-2026-113950

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULKREAD permission who can submit a cache query may trigger the...

CVE-2026-119542

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULKREAD permission who can submit a cache query may trigger the...

CVE-2026-119542 Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULKREAD permission who can submit a cache query may trigger the...

CVE-2026-119542 Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULKREAD permission who can submit a cache query may trigger the...