EUVD-2026-118417

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor exhausts the kernel stack and...

CVE-2026-122113

A vulnerability exists in Realtek's RtUsbA64.sys USB audio driver. A physically present attacker can use a maliciously crafted USB device to trigger unbounded recursion within the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor exhausts the kernel stac...

CVE-2026-93435

A flaw was found in node-redis-parser. A remote attacker, by sending crafted RESP REdis Serialization Protocol byte streams with repeated array headers, can exploit an unbounded recursion vulnerability in the RESP protocol parser. This can exhaust the V8 call stack, leading to an uncaught...

CVE-2026-109413

A flaw was found in Symfony YAML. A remote, unauthenticated attacker can trigger this vulnerability by submitting a specially crafted YAML document containing deeply nested inline collections, such as lists or mappings. Because the parser fails to enforce maximum nesting limits during inline...

pillow: Pillow: Denial of Service via unbounded recursion in PDF parser

A flaw was found in Pillow. The PDF parser fails to limit recursion depth when reading nested PDF data structures such as arrays and dictionaries. A remote attacker could exploit this vulnerability by supplying a specially crafted, deeply nested PDF file to an application processing PDFs in appen...

pillow: Pillow: Denial of Service via unbounded recursion in PDF parser

A flaw was found in Pillow. The PDF parser fails to limit recursion depth when reading nested PDF data structures such as arrays and dictionaries. A remote attacker could exploit this vulnerability by supplying a specially crafted, deeply nested PDF file to an application processing PDFs in appen...

pillow: Pillow: Denial of Service via unbounded recursion in PDF parser

A flaw was found in Pillow. The PDF parser fails to limit recursion depth when reading nested PDF data structures such as arrays and dictionaries. A remote attacker could exploit this vulnerability by supplying a specially crafted, deeply nested PDF file to an application processing PDFs in appen...

qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing

A flaw was found in Qt. This vulnerability, specifically an unbounded recursion in the QDomNode destructor during QDomDocument XML parsing, allows a remote attacker to trigger a denial-of-service DoS crash. By processing untrusted XML input, the affected system can become unresponsive, leading to...

qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing

A flaw was found in Qt. This vulnerability, specifically an unbounded recursion in the QDomNode destructor during QDomDocument XML parsing, allows a remote attacker to trigger a denial-of-service DoS crash. By processing untrusted XML input, the affected system can become unresponsive, leading to...

qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing

A flaw was found in Qt. This vulnerability, specifically an unbounded recursion in the QDomNode destructor during QDomDocument XML parsing, allows a remote attacker to trigger a denial-of-service DoS crash. By processing untrusted XML input, the affected system can become unresponsive, leading to...

qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing

A flaw was found in Qt. This vulnerability, specifically an unbounded recursion in the QDomNode destructor during QDomDocument XML parsing, allows a remote attacker to trigger a denial-of-service DoS crash. By processing untrusted XML input, the affected system can become unresponsive, leading to...

CVE-2026-115448 Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes the default root ACL is open can build a chain of nested znodes deep enough that taking a snapshot...

CVE-2026-115448

A vulnerability exists in Apache ZooKeeper (versions 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6) due to uncontrolled recursion during snapshot serialization. The server recurses one stack frame per znode level without a depth bound, allowing a client with znode creation privileges—facilitated by...

CVE-2026-115448

Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes the default root ACL is open can build a chain of nested znodes deep enough that taking a snapshot...

CVE-2026-121423

SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it,...

EUVD-2026-115955

SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it,...

CVE-2026-121423

SurrealDB versions before 3.3.0 are vulnerable to a Denial of Service (DoS) attack due to unbounded recursion in val::Value serialization . Authenticated users can trigger a stack overflow by executing UPDATE statements that wrap a stored array in itself, subsequently triggering the overflow duri...

CVE-2026-121423: surrealdb: SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the…

SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it,...

qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing

A flaw was found in Qt. This vulnerability, specifically an unbounded recursion in the QDomNode destructor during QDomDocument XML parsing, allows a remote attacker to trigger a denial-of-service DoS crash. By processing untrusted XML input, the affected system can become unresponsive, leading to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in clsbpfoffloadcmd. Reproducer on netdevsim: add a skipsw clsbpf filter, set the bpftcaccept debugfs knob to 0, then tc filt...