CVE-2026-66858 is a high-severity vulnerability in Apache Thrift before version 0.25.0. It involves uncontrolled recursion in the protocol skip routine of several Apache Thrift bindings, which do not enforce the binding's recursion limit. This can lead to stack exhaustion when processing deeply nested unknown fields. The affected components include the Python C++ accelerator, PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk, and OCaml libraries. The issue is fixed in Apache Thrift version 0.25.0.
CVE-2026-96288 is a high-severity vulnerability in Apache Thrift's Erlang bindings involving uncontrolled recursion and unbounded resource allocation. This flaw affects versions prior to 0.25.0 and can lead to resource exhaustion. The issue is fixed in Apache Thrift version 0.25.0.
CVE-2026-85493 is a high-severity vulnerability in Apache Thrift affecting versions before 0.25.0. It involves uncontrolled recursion in the Dart and Java ME bindings, which can lead to a denial of service or other impacts. The issue is fixed in version 0.25.0, and users are advised to upgrade to this version.
CVE-2026-94650 is a high-severity vulnerability in Apache Thrift's c_glib bindings caused by uncontrolled recursion. This flaw affects all versions before 0.25.0. The Apache Software Foundation has fixed the issue in version 0.25.0. Users are advised to upgrade to this version to mitigate the risk.
Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service via a crafted ASN.1 encoding of deeply nested constructed elements (for example SEQUENCE inside SEQUENCE, in definite-length DER or indefinite-length BER form), because each nesting level is parsed by a further recursive call with no bound on depth. About 2,000 levels (8 KB of DER) are enough to exhaust a 1.5 MB thread stack, the .NET main-thread default on Windows, and raise a StackOverflowException, which .NET cannot catch and which terminates the whole process; on threads with larger stacks, parse time instead grows quadratically with depth (about 9 seconds of CPU for a 64 KB input). Any path that parses untrusted ASN.1 is exposed, including X.509 certificates and CRLs, CMS/PKCS#7, PKCS#8/PKCS#12, OCSP and TLS Certificate messages.
CVE-2026-104020 is a high-severity vulnerability in Amazon Ion Python before version 0.15.0. It involves uncontrolled recursion in the Ion reader component, which can be triggered by a crafted, deeply nested Ion value. This flaw allows a remote unauthenticated attacker to cause a denial of service by crashing the application using the vulnerable library. The issue is fixed in version 0.15.0.
Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache PLC4X (PLC4Go) allow a malicious device, or an attacker able to inject network traffic, to crash or exhaust the memory of the client application,
causing a denial of service.
The individual defects are:
- Generated parsers pre-allocate arrays with the element count claimed on the wire (0.13.0 through 0.13.1).
- Transport read helpers allocate buffers of the size claimed on the wire without an upper bound.
- ADS and KNXnet/IP response handling indexes into received data without checking its length, causing a panic.
- ADS and EIP frame-length handling accepts, or arithmetically wraps to, a length of zero, breaking message framing.
- Recursive protocol types are parsed without a nesting-depth limit. The same defect in the Java implementation is covered by CVE-2026-102509 https://cveprocess.apache.org/cve5/CVE-2026-102509 .
Additionally, length and position arithmetic in generated serializers was performed in 16-bit integers. If an application forwards attacker-influenced payloads larger than 8 KB, the length field wraps, and the remainder of the payload may be interpreted by the receiving device (for example, an ADS PLC) as
additional, independent protocol messages.
This issue affects Apache PLC4X: from 0.11.0 before 1.0.0. PLC4Go is consumed as the Go module github.com/apache/plc4x/plc4go; versions refer to the corresponding Apache PLC4X releases.
Users are recommended to upgrade to version 1.0.0, which fixes the issue.
Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X (PLC4J) allow a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service.
In the OPC UA driver these defects are reachable before authentication: the offending data is parsed while the secure channel and session are being established, before the server's identity has been bound to it. Configuring a trusted server therefore does not prevent exploitation by an attacker who can
impersonate it.
The individual defects are:
- Length-prefixed byte strings are allocated at the size claimed on the wire before the length is checked against the data actually received (0.10.0 through 0.13.1).
- Array fields in generated protocol parsers pre-allocate a list with the element count claimed on the wire, allowing a single count field to trigger a multi-gigabyte allocation. This parser is shared by all PLC4J drivers; the OPC UA driver is the verified pre-authentication path (0.10.0 through 0.13.1).
- The OPC UA driver accumulates message chunks without enforcing the negotiated maximum chunk count and message size (0.12.0 through 0.13.1).
- The OPC UA driver pre-allocates collections using element counts received from the server (0.10.0 through 0.13.1).
- Recursive protocol types are parsed without a nesting-depth limit. The same defect in the Go implementation is covered by CVE-2026-102510 https://cveprocess.apache.org/cve5/CVE-2026-102510 .
This issue affects Apache PLC4X: from 0.10.0 before 1.0.0.
Users are recommended to upgrade to version 1.0.0, which fixes the issue.
CVE-2026-103087 is a high-severity vulnerability in the gosub-engine browser engine affecting versions up to 0.1.0 and main before commit 46868b3. It involves uncontrolled recursion caused by processing SVG documents with deeply nested elements, leading to stack exhaustion and application crashes. An attacker can exploit this by embedding a malicious SVG in an IMG element's SRC attribute, requiring only that a victim visits a crafted web page. The issue is fixed in commit 46868b3deae44544bee2a13e756772966dde950e.
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCP#handleMessage and ServerRMQ#handleMessage pass a client-controlled non-string pattern to JSON.stringify to derive the handler lookup key; sufficiently deep nesting throws RangeError: Maximum call stack size exceeded, and the unhandled promise rejection terminates Node.js under its default behavior. An attacker who can reach the TCP port or publish to the consumed RabbitMQ queue or exchange can crash the service on demand; other transports are not affected because their patterns arrive as strings. This issue is fixed in versions 11.2.4 and 12.0.2.
PyJWT versions from 2.13.0 up to but not including 2.14.0 contain a vulnerability where deeply nested JSON arrays in the JWT header cause a RecursionError during parsing. This error is not caught by the library's usual exception handling, resulting in an HTTP 500 server error and a full traceback logged. This allows unauthenticated attackers to cause a denial of service on JWT validation endpoints without crashing the server or exposing data. The issue is fixed in PyJWT 2.14.0.
CVE-2026-102278 is a high-severity vulnerability in the juliangruber brace-expansion library. It involves uncontrolled recursion in the expand_() function when processing deeply nested brace groups, which can exhaust the native stack and cause the Node.js process to terminate. This leads to a denial of service condition. The issue affects multiple versions prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, where the recursion occurs at comma-member and single-set expansion sites. The vulnerability is fixed in these versions.
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.
CVE-2026-91765 is a high-severity vulnerability in the PHP SOAP XML parser where the cleanup_xml_node() function recurses without a depth limit. This allows an unauthenticated attacker to send a SOAP request with extremely deep nesting, causing stack exhaustion and crashing the SoapServer process. The unbounded recursion also affects the SOAP value decoder and WSDL node search helper.
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1.
CVE-2026-78253 is a medium severity vulnerability in Qt's QXmlStreamReader::readElementText() function that allows denial of service via uncontrolled recursion. An attacker can cause an application crash by supplying a crafted XML document that triggers stack exhaustion.
js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load() does not bound nesting or dotted-key depth in the recursive parser at src/load/parser.ts or the interpreter at src/load/interpreter.ts, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call stack and throw a raw RangeError instead of the documented SyntaxParseError. Applications that parse attacker-controlled TOML and handle only SyntaxParseError can rethrow the unexpected exception, which can terminate a worker or process and cause denial of service. The exception is synchronous and catchable by consumers that handle all exceptions, and the issue does not affect confidentiality or integrity. This issue is fixed in version 1.1.3.