CWE-674 vulnerabilities

CVE-2026-81928 is a high-severity vulnerability in Net::DNS for Perl versions before 1.57. It involves uncontrolled recursion in the sig_data function when re-encoding DNS messages containing a misplaced TSIG record. This can lead to memory exhaustion and process termination. The issue arises because TSIG records in the answer or authority sections are not removed before re-encoding, causing infinite recursion. The vulnerability affects code paths that re-encode decoded messages, such as forwarders or proxies. Decoding alone does not trigger the issue, and the recursion only occurs if the TSIG carries an empty MAC. The vulnerability has a CVSS score of 7.5 and no known exploits in the wild. No patch or remediation information is provided.

CVE-2026-82797 is an uncontrolled recursion vulnerability in the Samsung Open Source rlottie library. It is triggered by serialized data containing nested payloads that cause excessive recursion, impacting availability. The vulnerability has a medium severity with a CVSS score of 5.5. It affects versions of rlottie before commit 8de0d9e6ca80ffef654965505981727b9fa06a51. No official patch or remediation guidance is currently available, and there are no known exploits in the wild.

CVE-2026-78228 is an uncontrolled recursion vulnerability in the ash-project's ash_oban component. It occurs when a user's on_error trigger action fails on the final job attempt, causing infinite recursion that exhausts CPU and memory, leading to denial of service. The issue affects versions from 0.8.0-rc.1 up to but not including 0.8.14. The vulnerability results from a recursive call to handle_error/4 that is not in tail position, causing unbounded memory growth and eventual worker process termination.

CVE-2026-75758 is an uncontrolled recursion vulnerability in the Elixir standard library affecting functions inspect/1, List.to_string/1, and List.to_charlist/1. It occurs when a specially crafted list with a printable prefix exceeding 4096 elements but containing invalid elements later causes repeated nested inspections, leading to process stack growth and potential memory exhaustion of the BEAM node. This vulnerability affects specific release candidate and stable versions of Elixir from 1.15.0-rc.0 up to but not including 1.18.5, 1.19.0-rc.0 up to but not including 1.19.6, and 1.20.0-rc.0 up to but not including 1.20.4.

CVE-2026-47851 is a high-severity vulnerability in Spring AI where analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. This uncontrolled recursion issue affects multiple versions of Spring AI, including 1.0.0 through 1.0.9, 1.1.0 through 1.1.8, and version 2.0.0. The vulnerability does not impact confidentiality or integrity but causes a denial of service due to application crash.

ORAS CLI versions up to and including 1.3.2 have a vulnerability where recursive referrer traversal does not track visited descriptors, allowing a malicious OCI registry to cause unbounded recursion and memory growth. This leads to client-side denial of service by exhausting CPU and memory resources, affecting commands like oras discover, backup, and restore. The issue is fixed in version 1.3.3.

CVE-2026-16781 is an uncontrolled recursion vulnerability in Autodesk 3ds Max triggered by parsing a maliciously crafted SVG file. Exploitation can cause the application to terminate unexpectedly, resulting in denial-of-service. The vulnerability affects specific versions of 3ds Max from 2026.0.0 up to but not including 2026.3.4, and from 2027.0.0 up to but not including 2027.2.0. The CVSS score is 5.5, indicating medium severity. No known exploits are reported in the wild, and no official patch information is provided in the input data.

Mistune versions 3.3.0 through 3.3.2 contain a denial-of-service vulnerability caused by uncontrolled recursion during HTML rendering of deeply nested emphasis tokens. This can trigger a Python RecursionError and crash the parsing process. The issue is resolved in version 3.3.3.

RaTeX versions prior to 0.1.11 contain a vulnerability where deeply nested LaTeX input causes uncontrolled recursion in the parser, leading to stack overflow and process abort. This results in a denial of service triggered by a crafted LaTeX string. The issue is fixed in version 0.1.11.

A vulnerability in django CMS versions prior to 5.0.8 allows a staff user with plugin-change permission to create a cycle in the plugin parent-child tree. This uncontrolled recursion can cause infinite database queries during plugin rendering, copying, or deletion, leading to resource exhaustion and corruption of the plugin tree. The issue is fixed in version 5.0.8.

deepmerge-ts versions prior to 8.0.0 have an uncontrolled recursion vulnerability in several deep merge APIs. The merging functions do not track visited objects or pairs, causing infinite recursion when merging objects with self-references at the same property path. This leads to a synchronous crash of the Node.js process due to a maximum call stack size exceeded error. The issue is fixed in version 8.0.0.

Eclipse OpenJ9 versions up to 0.60 contain a vulnerability where a crafted .class file with deeply nested annotations can cause a segmentation fault due to uncontrolled recursion. This issue is identified as CWE-674. The vulnerability has a medium severity with a CVSS score of 5.7.

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively for AMQP table type F and AMQP array type A values without a nesting-depth limit. A malicious AMQP server or network intermediary can send approximately 580 nested table levels in the pre-authentication connection.start frame, fitting within the default 131072-byte frame maximum, to trigger StackOverflowError. The error terminates the client input processing thread and causes denial of service. This issue is fixed in version 5.33.1.

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated against a sufficiently long name, exhausts the thread stack. Elasticsearch treats a stack overflow as an unrecoverable condition and shuts the node down, so the request terminates the affected node rather than failing gracefully.

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and terminating the affected node.

Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch node process and causing a denial of service for that node. An authenticated user holding only read-only privileges on a single searchable index can trigger the condition with one small search request.

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation causes the thread to exhaust its stack. The resulting fatal error is not handled by the surrounding execution paths and terminates the affected node process, producing a denial of service.

A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate) to submit a request that causes a self-referential data structure to be created. When a specific internal component later processes that structure, the operation recurses without bound and raises a fatal error that is not handled by the surrounding execution path, terminating the affected node process and resulting in a denial of service.