aws-smithy-json: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON

A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service DoS in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacker can trigger uncontrolled recursion in the aws-smithy-json...

Important: Red Hat Security Advisory: goose bug fix and enhancement update

An update for goose is now available for Red Hat Enterprise Linux 9. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Security Fixes: goose: aws-smithy-json: Denial of Service via uncontrolled...

Important: Red Hat Security Advisory: goose bug fix and enhancement update

An update for goose is now available for Red Hat Enterprise Linux 10. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Security Fixes: goose: aws-smithy-json: Denial of Service via uncontrolled...

aws-smithy-json: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON

A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service DoS in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacker can trigger uncontrolled recursion in the aws-smithy-json...

CVE-2019-13288

CVE-2019-13288 – Xpdf 的 Parser::getObj 中的无限递归 概述 CVE-2019-13288 是在 Xpdf 4.01.01 版本中发现的漏洞，具体位于 Parser.cc 的 Parser::getObj 函数中。此缺陷在处理特制的 PDF 文件时可能导致 无限递归 ，进而引发 拒绝服务 DoS 条件。该漏洞类似于 CVE-2018-16646 ，凸显了在递归函数中进行稳健输入验证的重要性。 技术细节 CVE 编号 ：CVE-2019-13288 受影响软件 ：Xpdf 4.01.01 漏洞类型 ：不受控递归 CWE-674 影响 ：拒绝服务 DoS...

CVE-2026-40345

deepmerge-ts mergeleft.self, right.self - mergeleft.self, right.self - mergeleft.self, right.self - RangeError: Maximum call stack size exceeded 当 deepmergeInto、deepmergeCustom 和 deepmergeIntoCustom 收到同类图时，也会出现相同的行为。 本地复现 在 package.json 中，该包被固定到受影响的 7.1.6 版本。 root@kitploit: npm install npm run po...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in protobuf-5.29.5-cp38-abi3-manylinux2014_x86_64.whl

Summary IBM Watson Discovery Cartridge affected by vulnerability in protobuf-5.29.5-cp38-abi3-manylinux2014x8664.whl Vulnerability Details CVEID:CVE-2026-0994 DESCRIPTION: A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth...

Linux Distros Unpatched Vulnerability : CVE-2026-19201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to...

commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input

A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...

commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input

A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...

CVE-2026-11573

A flaw was found in qtbase. Uncontrolled recursion in Qt's QDomDocument serialization QtXml allows a remote attacker to provide deeply nested untrusted XML, leading to stack exhaustion. This can cause the application to crash, resulting in a Denial of Service DoS. Mitigation To mitigate this issu...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Bouncy Castle for Java

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in Bouncy Castle for Java. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-59645 DESCRIPTION: In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referentia...

EUVD-2026-74300

An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to cause a denial of service DoS. The WinEvents.readELAMAggregation function recurses for every nested elamAggregation sub-event without...

CVE-2026-19201

An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to cause a denial of service DoS. The WinEvents.readELAMAggregation function recurses for every nested elamAggregation sub-event without...

Linux Distros Unpatched Vulnerability : CVE-2026-11573

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled recursion CWE-674 in the QDomDocument/QDomNode serialization path of the Qt XML module QtXml, qtbase. QDomElementPrivate::save and...

CVE-2026-77465

A flaw was found in toml-node. A remote, unauthenticated attacker can exploit an uncontrolled recursion vulnerability in the TOML parser by crafting a malicious TOML document with deeply nested arrays or inline tables. This can lead to the exhaustion of the Node.js call stack, causing a RangeErro...

CVE-2026-69378

Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network...

EUVD-2026-73128

Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network...

CVE-2026-69378

Microsoft Exchange Server is affected by an uncontrolled recursion vulnerability that allows an unauthenticated, remote attacker to cause a denial of service over the network. The CVSS 3.1 score is 7.5 (HIGH) with low attack complexity, no privileges required, and no user interaction needed. No s...

CVE-2026-73321

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to...