CVE-2026-100354 | High | 7.5 | 2026-10-15 | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an… |
CVE-2026-95155 | High | 7.5 | 2026-10-15 | FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supp… |
CVE-2026-109449 | | | 2026-10-15 | In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no… |
CVE-2026-95179 | High | 7.5 | 2026-10-15 | An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing… |
CVE-2026-109413 | | | 2026-10-15 | In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequenc… |
CVE-2026-110263 | Medium | 5.5 | 2026-10-14 | OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply n… |
CVE-2026-110259 | Medium | 5.5 | 2026-10-14 | OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of servi… |
CVE-2026-58280 | High | 7.5 | 2026-10-13 | Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-92876 | High | 7.5 | 2026-10-12 | IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion. |
CVE-2026-90912 | High | 7.5 | 2026-10-12 | IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion. |
CVE-2026-109267 | Medium | 5.3 | 2026-10-12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recurs… |
CVE-2026-109264 | Low | 3.7 | 2026-10-12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who con… |
CVE-2026-107833 | Medium | 5.9 | 2026-10-09 | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.g… |
CVE-2026-107826 | High | 7.5 | 2026-10-09 | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can s… |
CVE-2026-104635 | | | 2026-10-09 | Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding proces… |
CVE-2026-19498 | Medium | 5.9 | 2026-10-08 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to cause a denial of service… |
CVE-2026-107376 | High | 8.2 | 2026-10-08 | webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recurs… |
CVE-2026-107300 | High | 7.5 | 2026-10-08 | msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for each complete Message… |
CVE-2026-107298 | Medium | 5.3 | 2026-10-08 | msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an… |
CVE-2026-107678 | Medium | 4.7 | 2026-10-08 | FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncr… |
CVE-2026-44037 | Medium | 5.5 | 2026-10-08 | Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonr… |
CVE-2026-44036 | Medium | 5.5 | 2026-10-08 | Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter (dcmdata/libdcxml/… |
CVE-2026-44035 | Medium | 5.5 | 2026-10-08 | Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (s… |
CVE-2026-44033 | Medium | 5.5 | 2026-10-08 | Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows… |
CVE-2026-44031 | High | 7.5 | 2026-10-08 | Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker… |
CVE-2026-107216 | High | 7.5 | 2026-10-07 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, ANCHORARRAY recursively calls the exported CalcCe… |
CVE-2026-107208 | Medium | 5.3 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach… |
CVE-2026-106572 | Medium | 5.3 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check… |
CVE-2026-106449 | Low | 3.7 | 2026-10-06 | yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles e… |
CVE-2026-106447 | | | 2026-10-06 | StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR arrays, m… |
CVE-2026-103008 | Medium | 6.5 | 2026-10-06 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process… |
CVE-2026-103006 | Medium | 6.5 | 2026-10-06 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation fea… |
CVE-2026-102409 | Medium | 6.5 | 2026-10-06 | Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial o… |
CVE-2026-96289 | | | 2026-10-02 | Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to… |
CVE-2026-83663 | | | 2026-10-02 | Uncontrolled Recursion vulnerability in Apache Thrift go bindings.
Both Go transports satisfy a read out of a buffered frame and, when that frame yields no… |
CVE-2026-66858 | | | 2026-10-02 | The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough c… |
CVE-2026-96288 | | | 2026-10-02 | Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings.
This issue affects Apache Thrif… |
CVE-2026-94650 | | | 2026-10-02 | Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade… |
CVE-2026-85493 | | | 2026-10-02 | Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended t… |
CVE-2026-103600 | | | 2026-10-02 | Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unaut… |
CVE-2026-104020 | High | 7.5 | 2026-10-01 | Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the libra… |
CVE-2026-103118 | Medium | 4.3 | 2026-09-30 | A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the c… |
CVE-2026-102510 | | | 2026-09-30 | Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache… |
CVE-2026-102509 | | | 2026-09-30 | Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X (PLC… |
CVE-2026-103087 | | | 2026-09-30 | Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Se… |
CVE-2026-102497 | High | 7.5 | 2026-09-29 | The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious sch… |
CVE-2026-102496 | High | 7.5 | 2026-09-29 | Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until… |
CVE-2026-102495 | High | 7.5 | 2026-09-29 | Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows… |
CVE-2026-102281 | High | 7.5 | 2026-09-28 | Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pat… |
CVE-2026-102278 | High | 7.5 | 2026-09-28 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace g… |
CVE-2026-102276 | High | 7.5 | 2026-09-28 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace pattern… |
CVE-2026-102265 | Medium | 5.3 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueE… |
CVE-2026-100702 | Medium | 5.9 | 2026-09-26 | Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhausti… |
CVE-2026-91765 | High | 7.5 | 2026-09-25 | cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containi… |
CVE-2026-92564 | High | 7.5 | 2026-09-25 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qp… |
CVE-2026-61811 | Medium | 6.5 | 2026-09-24 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattribu… |
CVE-2026-95844 | High | 7.5 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through… |
CVE-2026-78253 | | | 2026-09-23 | Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaust… |
CVE-2026-95861 | High | 7.5 | 2026-09-22 | A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial o… |
CVE-2026-75655 | High | 7.8 | 2026-09-22 | Bridge is affected by an Uncontrolled Recursion vulnerability that could result in arbitrary code execution in the context of the current user. An attacker cou… |
CVE-2026-63386 | Medium | 5.3 | 2026-09-22 | js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load() does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the… |
CVE-2026-59168 | Medium | 6.2 | 2026-09-21 | Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decode… |
CVE-2026-91863 | High | 7.5 | 2026-09-21 | A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the pa… |
CVE-2026-65651 | | | 2026-09-21 | temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an app… |
CVE-2026-61551 | High | 8.6 | 2026-09-18 | Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth… |
CVE-2026-93687 | High | 7.5 | 2026-09-18 | braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patt… |
CVE-2026-59156 | Medium | 6.5 | 2026-09-18 | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0… |
CVE-2026-93450 | High | 7.5 | 2026-09-18 | go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no de… |
CVE-2026-93435 | High | 7.5 | 2026-09-17 | redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client pro… |
CVE-2026-54451 | | | 2026-09-17 | Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Proto… |
CVE-2026-52852 | Medium | 6.5 | 2026-09-17 | Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic… |
CVE-2026-89418 | | | 2026-09-17 | google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START… |
CVE-2026-19248 | | | 2026-09-16 | QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input. |
CVE-2026-12358 | High | 7.5 | 2026-09-15 | IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources. |
CVE-2026-91968 | Medium | 6.5 | 2026-09-15 | vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without rec… |
CVE-2026-53752 | High | 7.5 | 2026-09-14 | docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResol… |
CVE-2026-90472 | Medium | 5.3 | 2026-09-12 | msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nest… |
CVE-2026-88763 | Medium | 5.9 | 2026-09-10 | A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. T… |
CVE-2026-22591 | High | 7.5 | 2026-09-09 | eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14… |
CVE-2026-19201 | High | 7.5 | 2026-09-09 | An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to… |
CVE-2026-69378 | High | 7.5 | 2026-09-08 | Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network. |
CVE-2026-73321 | Medium | 6.5 | 2026-09-08 | XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of s… |
CVE-2026-11573 | | | 2026-09-08 | Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodeP… |
CVE-2026-17440 | Medium | 5.5 | 2026-09-04 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a… |
CVE-2026-77465 | High | 7.5 | 2026-09-03 | toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js who… |
CVE-2026-84851 | High | 7.5 | 2026-09-03 | An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts th… |
CVE-2026-14255 | Medium | 5.5 | 2026-09-02 | A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may lever… |
CVE-2026-84175 | | | 2026-09-02 | In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definitio… |
CVE-2026-81928 | High | 7.5 | 2026-09-02 | Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.
si… |
CVE-2026-52132 | High | 7.5 | 2026-09-01 | llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_alloc and HTTP 500) vi… |
CVE-2026-52130 | High | 7.5 | 2026-09-01 | llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service. |
CVE-2026-82797 | Medium | 5.5 | 2026-08-31 | Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads.
This issue affects rlottie: before 8de0d9e6ca… |
CVE-2026-82604 | Medium | 4.3 | 2026-08-31 | A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontr… |
CVE-2026-78228 | | | 2026-08-30 | Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's on_error action to fail on the final attempt to exhaust wo… |
CVE-2026-75758 | | | 2026-08-28 | Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_ch… |
CVE-2026-73209 | Medium | 6.5 | 2026-08-28 | An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process i… |
CVE-2026-81724 | Medium | 5.3 | 2026-08-27 | NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial… |
CVE-2026-47851 | High | 7.5 | 2026-08-27 | Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread.
Spring AI 2.0.0
Spring AI 1.1.0 - 1.1… |
CVE-2026-55588 | Medium | 6.5 | 2026-08-25 | ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive ref… |
CVE-2026-16781 | Medium | 5.5 | 2026-08-24 | A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this… |