CVE-2026-62296

A flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. The XHTML narrative parser does not limit element nesting depth, which allows a deeply nested narrative to trigger unbounded recursion. A remote attacker can exploit this vulnerability by submitting FHIR resources...

php: php: Denial of Service via unbounded recursion in SOAP parser

A flaw was found in PHP. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted request to an affected Simple Object Access Protocol SOAP server endpoint. Due to a lack of recursion depth limits when parsing deeply nested XML elements, processing suc...

CVE-2026-59156

A flaw was found in OpenImageIO, a toolset for reading, writing, and manipulating image files. A remote attacker could exploit this vulnerability by providing a specially crafted Flexible Image Transport System FITS stream. This stream, containing consecutive header blocks without the mandatory...

Fedora 43 : perl-Net-DNS (2026-48a4531e02)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-48a4531e02 advisory. Update to 1.57 to fix CVE-2026-81928 Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records Tenable has extracted the preceding...

Fedora 44 : perl-Net-DNS (2026-57f107ed83)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-57f107ed83 advisory. Update to 1.57 to fix CVE-2026-81928 Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records Tenable has extracted the preceding...

EUVD-2026-84017

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS...

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Summary dasel's JSON and XML readers parse nested structures with unbounded recursion, one native stack frame per nesting level, with no depth guard. A small sub-10 MB, deeply nested document drives the Go runtime past its goroutine stack limit and triggers a fatal error: stack overflow. This is...

CVE-2026-59168 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/jsonreader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard...

CVE-2026-59168 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/jsonreader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard...

CVE-2026-59168

The Dasel command-line tool and library (versions 3.0.0 through 3.11.0 ) are vulnerable to an unrecoverable Denial of Service (DoS) due to unbounded recursion in the JSON and XML readers. The decodeValue, decodeObject, and decodeArray functions in parsing/json/json_reader.go, along with parseElem...

CVE-2026-59168 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/jsonreader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard...

CVE-2026-68914

Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJONOJSONXS is enabled. An attacker who can supply untrusted JSON to decodejson, fromjson, or j can submit deeply nest...

MiracleLinux 8 : perl-Net-DNS-1.15-2.el8_10 (AXSA:2026-1885:02)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1885:02 advisory. perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records CVE-2026-81928 Tenable has extracted the preceding description...

SUSE SLES12 Security Update : perl-Net-DNS (SUSE-SU-2026:4065-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4065-1 advisory. This update for perl-Net-DNS fixes the following issue: - CVE-2026-81928: memory exhaustion via unbounded recursion in sigdata when...

MiracleLinux 9 : perl-Net-DNS-1.29-6.el9_8.1 (AXSA:2026-1884:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1884:01 advisory. perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records CVE-2026-81928 Tenable has extracted the preceding description...

RockyLinux 9 : perl-Net-DNS (RLSA-2026:68786)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:68786 advisory. perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records CVE-2026-81928 Tenable has extracted the preceding description bloc...

UBUNTU-CVE-2026-68914

Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON does not limit nesting depth when Cpanel::JSON::XS is unavailable or MOJONOJSONXS is enabled. An attacker who can supply untrusted JSON to decodejson, fromjson, or j can submit deeply nest...

SUSE SLED15 / SLES15 Security Update : perl-Net-DNS (SUSE-SU-2026:4086-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4086-1 advisory. This update for perl-Net-DNS fixes the following issue: - CVE-2026-81928: memory exhaustion via unbounded recursion in...

RLSA-2026:68786 Important: perl-Net-DNS security update

The perl-Net-DNS package contains a collection of Perl modules that act as a Domain Name System DNS resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of the gethostbyname and gethostbyaddr routines. Security Fixes: perl-Net-DNS: Net::DNS: Denial of Service...

perl-Net-DNS security update

An update is available for perl-Net-DNS. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The perl-Net-DNS package contains a collection of Perl modules that act ...