dnspython versions prior to 2.9.0 contain an uncontrolled recursion vulnerability in the dns.name.from_wire_parser function. This function follows DNS compression pointer chains without a hop limit, allowing a malicious DNS wire-format message to cause excessive pointer traversal. The result can be high CPU usage, application degradation, or denial of service when processing untrusted DNS messages. The issue is fixed in dnspython version 2.9.0.
CVE-2026-66282 is a vulnerability in Silicon Labs EmberZNet versions 9.1.1 and earlier. It involves uncontrolled recursion triggered by a malformed Publish Billing Period command, which causes a recursive function call without reaching its end condition. This issue affects only devices that have joined the network and support the Price Cluster. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.0.
CVE-2026-110974 is a vulnerability in the org.json parser within the com.vaadin.external.google:android-json library version 0.0.20131108.vaadin1. The parser uses uncontrolled recursion without a depth limit, causing a StackOverflowError when processing deeply nested JSON documents. This can cause the parsing thread to fail. No fixed version will be released for this artifact, which is an unmaintained repackaging of third-party org.json classes.
Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data.
Root Cause:
The bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests) recursively parses nested objects and arrays without any depth limit. For a protobuf message that references itself (e.g. a repeated message field), the generated parser recurses once per nesting level of the incoming mcpack object. A deeply nested request makes the recursion grow unbounded, overflow the stack and crash the process.
Affected Scenarios:
Use bRPC server with a recursive-schema protobuf message to serve nshead_mcpack / ubrpc / public_pbrpc requests from untrusted network.
How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3499
Note:
No matter which option you choose, you should know that the fix enforces the documented parsing depth limit MAX_DEPTH (128) on the parse path, the same limit the serializer already applies. If your requests contain mcpack messages nested deeper than 128 levels, the request will be failed after applying the fix.
CVE-2026-54427 is a vulnerability in Apache bRPC versions prior to 1.18.0 involving uncontrolled recursion in the AMF parser. A remote RTMP peer can cause a bRPC process to crash by sending deeply nested AMF objects or arrays, leading to native stack exhaustion. The issue affects applications using bRPC RTMP support that parse AMF data from untrusted sources. The vulnerability is fixed in version 1.18.0 by introducing a configurable maximum AMF nesting depth, defaulting to 128.
CVE-2026-54426 is a high-severity vulnerability in Apache bRPC versions before 1.18.0. It involves uncontrolled recursion in the Redis reply parser when processing deeply nested RESP array replies from a Redis server. This flaw allows a remote Redis server peer to crash a bRPC Redis client by sending replies with excessive nesting depth. The issue is fixed in version 1.18.0 by adding a configurable maximum reply depth limit, defaulting to 128, which rejects overly nested replies.
CVE-2026-54425 is a high-severity vulnerability in Apache bRPC before version 1.18.0 involving uncontrolled recursion in the HTTP/2 HPACK decoder. Remote attackers can cause a denial of service by sending crafted HTTP/2 header blocks with many consecutive Dynamic Table Size Update entries, leading to stack exhaustion. The issue is fixed in version 1.18.0 by replacing recursive parsing with iterative parsing.
CVE-2026-92391 is a high-severity vulnerability in curl where a deeply nested multipart MIME structure causes a stack overflow during cleanup. The issue arises from uncontrolled recursion in the curl_mime_free function, leading to unbounded stack frame allocation and crashing the host process.
ApostropheCMS versions prior to 4.34.0 and sanitize-html versions 2.18.0 before 2.18.1 contain an uncontrolled recursion vulnerability. This occurs when an <iframe> tag is disallowed and disallowedTagsMode is set to 'discard', causing recursive calls to sanitizeHtml without a termination condition. The flaw leads to a denial of service by exhausting resources. The issue is fixed in versions 4.34.0 of ApostropheCMS and 2.18.1 of sanitize-html.
CVE-2026-112895 is a high-severity vulnerability in the python-pillow Pillow library affecting versions from 5.1.0 up to but not including 13.0.0. It involves uncontrolled recursion in PDF parsing when appending to existing PDFs using Image.save with append=True. The PdfParser's linearize_page_tree function recurses through /Kids references without cycle or depth checks, allowing cyclic or duplicated page trees to cause unbounded recursion. Similarly, read_prev_trailer only guards against exact repeated offsets, permitting long unique chains to recurse deeply. This can lead to excessive CPU and memory consumption or a RecursionError, resulting in denial of service in applications processing user-supplied PDFs. The issue is fixed in Pillow 13.0.0 by adding a visited set and depth limit to the parsers.
CVE-2026-110673 is a high-severity vulnerability in Cpanel::JSON::XS for Perl versions before 4.80. It allows an attacker to cause stack exhaustion through uncontrolled recursion when decoding nested tagged values with the allow_tags feature. This leads to an uncatchable segmentation fault and denial of service. The issue is fixed in version 4.80.
CVE-2026-112368 is a high-severity vulnerability in the MongoDB PHP driver involving uncontrolled recursion in the BSON decoding logic. An unauthenticated attacker who can supply crafted binary document data may cause the PHP process to exhaust its stack and terminate unexpectedly, leading to a denial of service. This issue occurs beneath the PHP layer and cannot be caught by application-level error handling. Fixed versions are available.
Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.
CVE-2026-100354 is a high-severity vulnerability in kin-openapi versions prior to 0.149.0 involving uncontrolled recursion in runtime schema validation. While the spec loader and spec-time validator safely handle circular schema references, the runtime validators lack cycle detection, causing unbounded recursion when validating request or response data against schemas with circular allOf/anyOf/oneOf references. This leads to a fatal stack overflow in Go, crashing the entire server process and terminating all goroutines, including those serving unrelated clients. The vulnerability affects both response validation and request parameter decoding paths. No recoverable panic occurs, making the failure unrecoverable and causing a complete process termination.
CVE-2026-109449 is a high-severity vulnerability in the Symfony ExpressionLanguage component affecting versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9. The parser does not limit the depth of its node tree, allowing expressions with extremely deep nesting to cause uncontrolled recursion. This can crash the PHP process when freeing the node tree. Applications that validate user-supplied expressions using #[Assert\ExpressionSyntax] or parse untrusted expressions are vulnerable to denial-of-service via a single crafted request.
CVE-2026-109413 is a high-severity vulnerability in the Symfony YAML component affecting versions prior to 5.4.54, 6.4.45, 7.4.18, and 8.1.6. The issue arises from uncontrolled recursion in the YAML parser's lexInlineStructure function, which does not properly limit nesting levels for inline collections. This can cause stack exhaustion and crash the process or cause a fatal error when parsing deeply nested YAML input. Any code parsing untrusted YAML is vulnerable, including endpoints using #[MapRequestPayload] without restricting the accepted format. The vulnerability is exploitable without authentication by sending a crafted YAML payload.
CVE-2026-58280 is a vulnerability in Microsoft .NET runtime versions including 3.0.0.0, 3.5.0, 4.7.x, 4.8.x, 8.0.x, 9.0.x, 10.0.x, 11.0.0-rc.1, 17.14.x, and 18.10.x. It involves uncontrolled recursion that can be exploited by an unauthorized attacker to cause a denial of service over a network. The vulnerability has a high severity score of 7.5 and has been officially fixed in multiple versions. No known exploits are reported in the wild.
IBM Maximo AI Service versions 9.1.0 and 9.2.0 contain a vulnerability involving uncontrolled recursion that can be triggered remotely, leading to a denial of service condition. This flaw does not impact confidentiality or integrity but can cause service unavailability. The vulnerability is identified as CWE-674 and has a CVSS 3.1 score of 7.5, indicating high severity. No patch or remediation details are currently provided, and there are no known exploits in the wild.
IBM Maximo Application Suite - IoT Component versions 9.0.0, 9.1.0, and 9.2.0 contain a vulnerability due to uncontrolled recursion that can be exploited remotely to cause a denial of service. This vulnerability does not impact confidentiality or integrity but results in service disruption.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have a stack overflow vulnerability in the MSL decoder due to an incorrect depth check that allows uncontrolled recursion. This flaw can be triggered by specially crafted MSL images, causing the process to crash and resulting in a denial of service.