CVE-2026-82604

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-82604", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-30T07:14:40.141Z", "datePublished": "2026-08-31T02:00:13.384Z", "dateUpdated": "2026-08-31T16:10:48.833Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-31T02:00:13.384Z"}, "title": "BareBones BBEdit Java Language recursion", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-674", "lang": "en", "description": "Uncontrolled Recursion"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-404", "lang": "en", "description": "Denial of Service"}]}], "affected": [{"vendor": "BareBones", "product": "BBEdit", "versions": [{"version": "15.5.0", "status": "affected"}, {"version": "15.5.1", "status": "affected"}, {"version": "15.5.2", "status": "affected"}, {"version": "15.5.3", "status": "affected"}, {"version": "15.5.4", "status": "affected"}, {"version": "15.5.5", "status": "affected"}, {"version": "16.0", "status": "unaffected"}], "cpes": ["cpe:2.3:a:barebones:bbedit:*:*:*:*:*:*:*:*"], "modules": ["Java Language Module"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontrolled recursion. Remote exploitation of the attack is possible. Upgrading to version 16.0 is recommended to address this issue. You should upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-08-30T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-30T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-30T09:19:51.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "ciphersecuritylabs (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/397106", "name": "VDB-397106 | BareBones BBEdit Java Language recursion", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/397106/cti", "name": "VDB-397106 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-82604", "name": "CVE-2026-82604 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/892839", "name": "Submit #892839 | BareBones BBEdit 15.5.5 Denial of Service", "tags": ["third-party-advisory"]}, {"url": "https://ciphersecuritylabs.com/research/articles/fuzzing-bbedit-language-modules-stack-exhaustion-and-infinite-loop-dos-bugs", "tags": ["related"]}, {"url": "https://www.barebones.com/support/bbedit/notes-16.0.html", "tags": ["related"]}, {"url": "https://www.barebones.com/store/bbedit_upgrades.html", "tags": ["patch"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-31T16:10:35.917124Z", "id": "CVE-2026-82604", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T16:10:48.833Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-82604", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-31T16:10:35.917124Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T16:10:42.928Z"}}], "cna": {"title": "BareBones BBEdit Java Language recursion", "credits": [{"lang": "en", "type": "reporter", "value": "ciphersecuritylabs (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:barebones:bbedit:*:*:*:*:*:*:*:*"], "vendor": "BareBones", "modules": ["Java Language Module"], "product": "BBEdit", "versions": [{"status": "affected", "version": "15.5.0"}, {"status": "affected", "version": "15.5.1"}, {"status": "affected", "version": "15.5.2"}, {"status": "affected", "version": "15.5.3"}, {"status": "affected", "version": "15.5.4"}, {"status": "affected", "version": "15.5.5"}, {"status": "unaffected", "version": "16.0"}]}], "timeline": [{"lang": "en", "time": "2026-08-30T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-30T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-30T09:19:51.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/397106", "name": "VDB-397106 | BareBones BBEdit Java Language recursion", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/397106/cti", "name": "VDB-397106 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-82604", "name": "CVE-2026-82604 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/892839", "name": "Submit #892839 | BareBones BBEdit 15.5.5 Denial of Service", "tags": ["third-party-advisory"]}, {"url": "https://ciphersecuritylabs.com/research/articles/fuzzing-bbedit-language-modules-stack-exhaustion-and-infinite-loop-dos-bugs", "tags": ["related"]}, {"url": "https://www.barebones.com/support/bbedit/notes-16.0.html", "tags": ["related"]}, {"url": "https://www.barebones.com/store/bbedit_upgrades.html", "tags": ["patch"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontrolled recursion. Remote exploitation of the attack is possible. Upgrading to version 16.0 is recommended to address this issue. You should upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "Uncontrolled Recursion"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-404", "description": "Denial of Service"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-31T02:00:13.384Z"}}}, "cveMetadata": {"cveId": "CVE-2026-82604", "state": "PUBLISHED", "dateUpdated": "2026-08-31T16:10:48.833Z", "dateReserved": "2026-08-30T07:14:40.141Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-31T02:00:13.384Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:barebones:bbedit:*:*:*:*:*:*:*:*"], "modules": ["Java Language Module"], "product": "BBEdit", "vendor": "BareBones", "versions": [{"status": "affected", "version": "15.5.0"}, {"status": "affected", "version": "15.5.1"}, {"status": "affected", "version": "15.5.2"}, {"status": "affected", "version": "15.5.3"}, {"status": "affected", "version": "15.5.4"}, {"status": "affected", "version": "15.5.5"}, {"status": "unaffected", "version": "16.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontrolled recursion. Remote exploitation of the attack is possible. Upgrading to version 16.0 is recommended to address this issue. You should upgrade the affected component."}], "id": "CVE-2026-82604", "lastModified": "2026-08-31T20:56:08.800", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-82604", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-31T16:10:35.917124Z", "version": "2.0.3"}}]}, "published": "2026-08-31T02:17:03.370", "references": [{"source": "cna@vuldb.com", "url": "https://ciphersecuritylabs.com/research/articles/fuzzing-bbedit-language-modules-stack-exhaustion-and-infinite-loop-dos-bugs"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-82604"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/892839"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/397106"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/397106/cti"}, {"source": "cna@vuldb.com", "url": "https://www.barebones.com/store/bbedit_upgrades.html"}, {"source": "cna@vuldb.com", "url": "https://www.barebones.com/support/bbedit/notes-16.0.html"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-404"}, {"lang": "en", "value": "CWE-674"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[15.5.0,15.5.5]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "16.0"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "BBEdit", "source": "cna", "vendor": "BareBones"}, "product": "bbedit", "vendor": "barebones"}], "created": "2026-08-31T03:30:04.980259+00:00", "updated": "2026-08-31T03:30:05.266855+00:00", "vendors": ["barebones", "barebones$PRODUCT$bbedit"]}