CVE-2026-103118 | Medium | 4.3 | 2026-09-30 | A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the c… |
CVE-2026-102510 | | | 2026-09-30 | Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache… |
CVE-2026-102509 | | | 2026-09-30 | Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X (PLC… |
CVE-2026-103087 | | | 2026-09-30 | Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Se… |
CVE-2026-102497 | High | 7.5 | 2026-09-29 | The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious sch… |
CVE-2026-102496 | High | 7.5 | 2026-09-29 | Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until… |
CVE-2026-102495 | High | 7.5 | 2026-09-29 | Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows… |
CVE-2026-102281 | High | 7.5 | 2026-09-28 | Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pat… |
CVE-2026-102278 | High | 7.5 | 2026-09-28 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace g… |
CVE-2026-102276 | High | 7.5 | 2026-09-28 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace pattern… |
CVE-2026-102265 | Medium | 5.3 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueE… |
CVE-2026-100702 | Medium | 5.9 | 2026-09-26 | Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhausti… |
CVE-2026-91765 | High | 7.5 | 2026-09-25 | cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containi… |
CVE-2026-92564 | High | 7.5 | 2026-09-25 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qp… |
CVE-2026-61811 | Medium | 6.5 | 2026-09-24 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattribu… |
CVE-2026-95844 | High | 7.5 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through… |
CVE-2026-78253 | | | 2026-09-23 | Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaust… |
CVE-2026-95861 | High | 7.5 | 2026-09-22 | A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial o… |
CVE-2026-75655 | High | 7.8 | 2026-09-22 | Bridge is affected by an Uncontrolled Recursion vulnerability that could result in arbitrary code execution in the context of the current user. An attacker cou… |
CVE-2026-63386 | Medium | 5.3 | 2026-09-22 | js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load() does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the… |
CVE-2026-59168 | Medium | 6.2 | 2026-09-21 | Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decode… |
CVE-2026-91863 | High | 7.5 | 2026-09-21 | A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the pa… |
CVE-2026-65651 | | | 2026-09-21 | temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an app… |
CVE-2026-61551 | High | 8.6 | 2026-09-18 | Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth… |
CVE-2026-93687 | High | 7.5 | 2026-09-18 | braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patt… |
CVE-2026-59156 | Medium | 6.5 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0… |
CVE-2026-93450 | High | 7.5 | 2026-09-18 | go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no de… |
CVE-2026-93435 | High | 7.5 | 2026-09-17 | redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client pro… |
CVE-2026-54451 | | | 2026-09-17 | Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Proto… |
CVE-2026-52852 | Medium | 6.5 | 2026-09-17 | Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic… |
CVE-2026-89418 | | | 2026-09-17 | google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START… |
CVE-2026-19248 | | | 2026-09-16 | QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input. |
CVE-2026-12358 | High | 7.5 | 2026-09-15 | IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources. |
CVE-2026-91968 | Medium | 6.5 | 2026-09-15 | vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without rec… |
CVE-2026-53752 | High | 7.5 | 2026-09-14 | docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResol… |
CVE-2026-90472 | Medium | 5.3 | 2026-09-12 | msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nest… |
CVE-2026-88763 | Medium | 5.9 | 2026-09-10 | A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. T… |
CVE-2026-22591 | High | 7.5 | 2026-09-09 | eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14… |
CVE-2026-19201 | High | 7.5 | 2026-09-09 | An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to… |
CVE-2026-69378 | High | 7.5 | 2026-09-08 | Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network. |
CVE-2026-73321 | Medium | 6.5 | 2026-09-08 | XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of s… |
CVE-2026-11573 | | | 2026-09-08 | Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodeP… |
CVE-2026-17440 | Medium | 5.5 | 2026-09-04 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a… |
CVE-2026-77465 | High | 7.5 | 2026-09-03 | toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js who… |
CVE-2026-84851 | High | 7.5 | 2026-09-03 | An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts th… |
CVE-2026-14255 | Medium | 5.5 | 2026-09-02 | A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may lever… |
CVE-2026-84175 | | | 2026-09-02 | In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definitio… |
CVE-2026-81928 | High | 7.5 | 2026-09-02 | Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.
si… |
CVE-2026-52132 | High | 7.5 | 2026-09-01 | llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_alloc and HTTP 500) vi… |
CVE-2026-52130 | High | 7.5 | 2026-09-01 | llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service. |
CVE-2026-82797 | Medium | 5.5 | 2026-08-31 | Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads.
This issue affects rlottie: before 8de0d9e6ca… |
CVE-2026-82604 | Medium | 4.3 | 2026-08-31 | A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontr… |
CVE-2026-78228 | | | 2026-08-30 | Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's on_error action to fail on the final attempt to exhaust wo… |
CVE-2026-75758 | | | 2026-08-28 | Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_ch… |
CVE-2026-73209 | Medium | 6.5 | 2026-08-28 | An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process i… |
CVE-2026-81724 | Medium | 5.3 | 2026-08-27 | NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial… |
CVE-2026-47851 | High | 7.5 | 2026-08-27 | Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread.
Spring AI 2.0.0
Spring AI 1.1.0 - 1.1… |
CVE-2026-55588 | Medium | 6.5 | 2026-08-25 | ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive ref… |
CVE-2026-16781 | Medium | 5.5 | 2026-08-24 | A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this… |
CVE-2026-76098 | High | 7.5 | 2026-08-24 | Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering… |
CVE-2026-9769 | High | 7.5 | 2026-08-23 | justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.fini… |
CVE-2026-66393 | High | 7.5 | 2026-08-22 | NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by s… |
CVE-2026-53531 | | | 2026-08-21 | RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stac… |
CVE-2026-63462 | High | 7.5 | 2026-08-21 | Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-err… |
CVE-2026-17121 | High | 7.5 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled recursion. |
CVE-2026-54623 | High | 7.1 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/adm… |
CVE-2026-40345 | | | 2026-08-20 | deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeIn… |
CVE-2026-16440 | | | 2026-08-19 | In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault. |
CVE-2026-69220 | | | 2026-08-18 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabb… |
CVE-2026-74795 | High | 7.5 | 2026-08-16 | Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does not enforce a default expression depth l… |
CVE-2026-74794 | High | 7.5 | 2026-08-16 | Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers c… |
CVE-2026-74792 | High | 7.5 | 2026-08-16 | Scriban before 7.0.0 (affected versions <= 6.6.0) contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers… |
CVE-2026-74787 | High | 7.5 | 2026-08-16 | Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference det… |
CVE-2026-74783 | High | 7.5 | 2026-08-16 | Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressio… |
CVE-2026-17177 | High | 7.5 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to uncontrolled recursion. |
CVE-2026-72686 | Medium | 6.5 | 2026-08-13 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal com… |
CVE-2026-72683 | Medium | 6.5 | 2026-08-13 | A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api… |
CVE-2026-72679 | Medium | 6.5 | 2026-08-13 | Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pat… |
CVE-2026-72647 | Medium | 6.5 | 2026-08-13 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user hol… |
CVE-2026-72638 | Medium | 6.5 | 2026-08-13 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low… |
CVE-2026-72636 | Medium | 6.5 | 2026-08-13 | Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matche… |
CVE-2026-73566 | High | 7.5 | 2026-08-13 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an… |
CVE-2026-62296 | High | 7.5 | 2026-08-07 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum e… |
CVE-2026-62295 | High | 7.5 | 2026-08-07 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fh… |
CVE-2026-32327 | Critical | 9.1 | 2026-08-06 | A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the… |
CVE-2026-15996 | High | 7.5 | 2026-08-05 | A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and ex… |
CVE-2026-61483 | High | 7.5 | 2026-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy.
This issue affects Apache Lucy: all versions.
As this project is ret… |
CVE-2026-68073 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qp… |
CVE-2026-67590 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qp… |
CVE-2026-67552 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qp… |
CVE-2026-66274 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qp… |
CVE-2026-15830 | Medium | 5.3 | 2026-08-04 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-o… |
CVE-2026-46714 | | | 2026-08-03 | Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Missk… |
CVE-2026-13506 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.1… |
CVE-2026-59645 | High | 7.5 | 2026-08-03 | In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle fo… |
CVE-2026-67321 | High | 7.5 | 2026-08-01 | axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level… |
CVE-2026-18140 | High | 7.5 | 2026-07-30 | Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every g… |
CVE-2026-67194 | Medium | 6.5 | 2026-07-29 | Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH… |
CVE-2026-67215 | High | 7.5 | 2026-07-29 | cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyP… |
CVE-2026-58178 | High | 7.5 | 2026-07-29 | The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs.
This issue affects Apache Traffic Server: from 8.0.0 throug… |