Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 741

Export CSV
CVE-2026-121092

chromium-browser: Uncontrolled recursion in SVG

Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-63475

isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Isomorphic-git
Products
Isomorphic-git
CVE-2026-119376

SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sqlite
Products
Sqlite
CVE-2026-119191

Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Digitalbazaar
Products
Forge
CVE-2026-119187

Forge: Denial of service in TLS record processing via call stack exhaustion

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Digitalbazaar
Products
Forge
CVE-2026-119123

ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder

ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-115290

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Elastic
Products
Elasticsearch
CVE-2026-119542

Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially affecting availability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Build Of Apache Camel For Quarkus Camel Quarkus and 7 more
CVE-2026-120689

Uncontrolled Recursion in HDF5 H5B__iterate_helper() via Crafted File

HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node’s level matches the expected level. That check is performed only in H5B__cache_deserialize() when a node is first loaded into the metadata cache. A crafted HDF5 file whose B-tree child pointer refers back to a node already in the cache, such as a node that points to itself, bypasses the check and causes unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Gget_info() or H5Gget_num_objs() on a group in the crafted file, which reaches H5B_iterate() through H5G__obj_info() and H5G__stab_count(). An attacker who can get a user or application to open a malicious file can cause a denial of service.

CVSS 4.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hdfgroup
Products
Hdf5
CVE-2026-119371

SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sqlite
Products
Sqlite
CVE-2026-65628

Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types

jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type (kty) module, and its fallback clause re-invokes itself as shared_secret(from(YourJWK), from(MyJWK)). Because from/1 returns an already-parsed jose_jwk record unchanged, passing two JWKs whose key types differ (for example an EC key and an RSA key) makes the fallback clause re-enter with identical arguments, producing an unbounded tail-recursive loop that never returns and never crashes. An application that derives a shared secret from an externally supplied peer public key without first checking that the peer key's type and curve match its own key can be driven into this loop by an attacker-controlled JWK, pinning an Erlang scheduler at 100% CPU. Repeated requests exhaust the available schedulers, resulting in a denial of service. This issue affects jose: from 1.5.0 before 1.11.13.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Potatosalad
Products
Jose
CVE-2026-101180

Denial of Service via File Parsing Module in HarmonyOS

DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Huawei
Products
Harmonyos
CVE-2026-120420

drools-drl-parser: uncontrolled recursion when parsing deeply nested parenthesised expressions leads to denial of service (StackOverflowError)

A denial-of-service vulnerability was found in the Drools DRL expression parser (org.drools:drools-drl-parser). The ANTLR4-generated DRL expression grammar parses parenthesised sub-expressions through mutually recursive descent rules with no limit on nesting depth. When a deeply nested parenthesised constraint expression (approximately 300-400 levels) is parsed, the parsing thread exhausts its stack and a java.lang.StackOverflowError is raised and propagates out of the parse call instead of being converted into a DroolsParserException. An actor able to supply a crafted DRL expression to an application that parses untrusted DRL can cause a denial of service.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-61847

Crass: A large number of adjacent CSS comments can trigger a SystemStackError

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a `SystemStackError`, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Rgrove
Products
Crass
CVE-2026-62303

Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)

Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecutive slash characters can recurse deeply enough to exhaust the stack and crash the process. `Router::route()`, `Router::addRoute()` and `Router::removeRoute()` reach this normalization. Unauthenticated remote exploitation is conditional on a deployment allowing sufficiently long request paths, such as by increasing `Endpoint::Options::maxRequestSize()` above the default 4096-byte limit or forwarding long paths through a front end. Direct router API use is also affected when attacker-controlled route or resource strings reach the normalizer. Native builds reproduced a crash around 24,000 consecutive slashes, although the exact threshold depends on the stack and standard library; the demonstrated failure is stack exhaustion rather than uninitialized-memory use. A source fix replaces recursive regular-expression normalization with an iterative pass, but no containing repository release was verified as of time of publication.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Pistacheio
Products
Pistache
CVE-2026-106972

rybakit/msgpack: rybakit/msgpack: Denial of Service via uncontrolled recursion

Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application decodes deeply nested, attacker-controlled MessagePack input.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Rybakit
Products
Msgpack.php
CVE-2026-119762

Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Axigen
Products
Axigen Mail Server
CVE-2026-116586

Go JOSE: Panics in JSON parsing

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Go-jose
Products
Go-jose
CVE-2026-110974

Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException. Any application that parses untrusted JSON with this library can be made to fail the thread doing the parsing. The artifact is a 2013 repackage of third-party org.json classes, published once and never maintained, and no fixed version will be released. Users of the affected version should apply the following mitigation. Product version com.vaadin.external.google:android-json 0.0.20131108.vaadin1 Mitigation No fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin.external.google:android-json / 0.0.20131108.vaadin1 / none

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vaadin
Products
Android-json