ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have an uncontrolled recursion vulnerability in the MVG decoder. This flaw can cause a stack overflow when processing a crafted file name, leading to a denial of service by crashing the process.
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. Request JSON processing is not affected by this specific path because it uses the configured request recursion limit, and exploitation requires response-body inspection to be enabled. This issue is fixed in version 3.8.0.
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An unauthenticated attacker can submit shallow values followed by an extremely deeply nested JSON tail that was not visited by the bounded walk, causing gjson.Valid to recurse without a depth bound and terminate the hosting process with an unrecoverable fatal stack overflow. The ProcessRequest and ProcessResponse JSON paths share the affected readJSON validation flow, and the payload can remain within recommended body-size and argument-count limits. This issue is fixed in version 3.8.1.
CVE-2026-104635 is an uncontrolled recursion vulnerability in the elixir-protobuf protobuf library's JSON decoding functionality. It allows unauthenticated remote attackers to crash the decoding process by supplying a deeply nested JSON document that triggers infinite recursion in self-referential or cyclic message types. This affects applications using Protobuf.JSON.decode/3, decode!/3, or from_decoded/3 with vulnerable versions of the protobuf library. The flaw does not impact confidentiality or integrity but can cause denial of service by exhausting memory.
CVE-2026-19498 is a medium severity vulnerability in IBM Security Verify Access and IBM Verify Identity Access versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. It involves uncontrolled recursion that could be triggered remotely, leading to a denial of service condition. No confidentiality or integrity impacts are indicated. The vulnerability requires high attack complexity and no privileges or user interaction. No known exploits are reported, and no patch information is provided.
CVE-2026-107376 is a high-severity vulnerability in webonyx graphql-php prior to version 15.32.3. It involves uncontrolled recursion in the parser component, allowing a remote attacker to submit deeply nested GraphQL queries that exhaust the PHP process stack. This can cause segmentation faults (SIGSEGV) that terminate PHP-FPM workers or long-running PHP processes such as Swoole, RoadRunner, ReactPHP, or CLI. The issue occurs before query validation and complexity controls, and cannot be caught by application-level exception handling. The vulnerability is fixed in version 15.32.3.
### Impact
The streaming decoder recursively invokes itself for every complete value remaining in a chunk. A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.
### Patches
The streaming decoder now drains concatenated values iteratively with constant call-stack depth.
### Workarounds
Limit the number of MessagePack values accepted in one chunk, or split large batches before passing them to the decoder stream.
msgpack5 versions prior to 6.1.0 have an uncontrolled recursion vulnerability in their array and map decoding paths. This allows an attacker to submit deeply nested MessagePack input that exhausts the JavaScript call stack, causing process interruption. The issue is fixed in version 6.1.0.
CVE-2026-44037 is a medium severity vulnerability in OFFIS DCMTK version 3.7.0 involving uncontrolled mutual recursion in the DcmJSONReader component. This flaw allows denial of service via crafted DICOM JSON documents with deeply nested sequences, causing stack exhaustion and process crashes. The issue affects the json2dcm tool and any service converting untrusted DICOM JSON using this reader. A fix has been implemented in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7.
Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter (dcmdata/libdcxml/xml2dcm.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML file with deeply nested sequence and item elements. The xml2dcm tool and any service that converts untrusted XML to DICOM with this code are affected. The issue is fixed in commit 87f256d73e30656a822bf7d76d1cf1d9bb693954.
Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute. Any application that opens the DICOMDIR is affected, including dcmgpdir and media viewers built on DCMTK. The issue is fixed in commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f.
Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. The issue is fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.
Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The dataset can be sent in a C-STORE request to storescp, dcmrecv, dcmqrscp, or any other DICOM service built on DCMTK, because the received dataset is parsed before any authentication takes place. Local tools such as dcmdump also crash when opening such a file. The issue is fixed in commit 885ff0f10372bd589b5f44cea974f28a3964cb0f, which adds a configurable sequence nesting depth limit (default 64).
CVE-2026-107216 is a high-severity vulnerability in the qax-os excelize Go library versions 2.8.1 through 2.11.0. It involves uncontrolled recursion caused by the ANCHORARRAY function recursively calling CalcCellValue, which creates a new calculation context on each call and bypasses cycle detection mechanisms. This leads to a fatal Go stack overflow and process abort when mutually referencing dynamic-array formulas are evaluated. No fix is currently available.
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4.
CVE-2026-103008 is an uncontrolled recursion vulnerability in Elastic Elasticsearch that can cause a denial of service. It arises from how Elasticsearch builds and serializes geometry values produced by scripted runtime fields without bounding recursion depth. An authenticated user with read access can submit a crafted request that triggers deep recursion, exhausting stack space and terminating the node. The node may not automatically recover, requiring manual intervention. The vulnerability affects multiple Elasticsearch versions from 8.12.0 through 9.5.4.
CVE-2026-103006 is an uncontrolled recursion vulnerability in Elasticsearch's search aggregation feature. An authenticated user with read access to an index can submit a deeply nested aggregation request that triggers unbounded recursion. This leads to resource exhaustion and causes the affected node to terminate and require manual recovery. The vulnerability affects multiple versions of Elasticsearch from 8.0.0 through 8.19.20, 9.0.0 through 9.4.5, and 9.5.0 through 9.5.1. The CVSS score is 6.5, indicating medium severity.
CVE-2026-102409 is an uncontrolled recursion vulnerability in Elastic Elasticsearch that allows an authenticated user with low privileges to cause a denial of service by terminating an Elasticsearch node. The issue arises from excessive allocation leading to resource exhaustion. It affects multiple 9.x versions of Elasticsearch. The vulnerability has a medium severity rating with a CVSS score of 6.5. No known exploits are reported in the wild and no official patch information is provided in the source data.
CVE-2026-96289 is a high-severity vulnerability in Apache Thrift's PHP bindings caused by uncontrolled recursion. This flaw affects all versions before 0.25.0. The issue has been addressed in Apache Thrift version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.
CVE-2026-83663 is an uncontrolled recursion vulnerability in the Go bindings of Apache Thrift before version 0.25.0. The issue arises because the Go transports read frames recursively when encountering frames with no payload bytes, leading to unbounded recursion depth. This causes the Go runtime stack limit to be exceeded, resulting in a fatal error that terminates the entire process. The vulnerability has a high severity with a CVSS score of 8.7. Users are advised to upgrade to Apache Thrift version 0.25.0, which contains the fix.