CWE-674 vulnerabilities

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads. This issue affects rlottie: before e2d19e3b150e0e4a9586fa90b56fd3061cc98945.

Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation, Oversized Serialized Data Payloads. This issue affects rlottie: before eae37633fda13ac05b25c6c95aacea4bc33c80a3.

CVE-2026-8936 is a high-severity vulnerability affecting Docker Desktop version 4.33.0. It involves uncontrolled recursion in the grpcfuse kernel module, which can cause a virtual machine panic when a container creates deeply nested directories on a bind-mounted host folder. This triggers a dentry invalidation event leading to the issue. The vulnerability has been fixed in Docker Desktop version 4.76.0.

CVE-2026-40989 is a medium severity vulnerability in Spring Cloud Function involving uncontrolled recursion in the routing layer. This flaw can cause an out-of-memory (OOM) condition, resulting in denial of service. It does not affect confidentiality but impacts availability due to resource exhaustion. The vulnerability affects specific versions of Spring Cloud Function. No official patch or remediation guidance is currently confirmed.

The go-billy filesystem abstraction for Go prior to version 5.9.0 and including 6.0.0-alpha.1 contains vulnerabilities related to uncontrolled recursion and improper handling of malformed input. These issues can cause panics, infinite loops, or excessive resource consumption due to missing safety mechanisms like cycle detection and recursion limits. The vulnerability has been addressed in versions 5.9.0 and 6.0.0-alpha.1.

The go-ipld-prime library versions prior to 0.23.0 contain a vulnerability where the DAG-CBOR and DAG-JSON decoders perform uncontrolled recursion on deeply nested collections without a depth limit. This causes the Go runtime to terminate the process due to a fatal stack overflow. The issue is fixed in version 0.23.0.

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a denial-of-service attack due to uncontrolled recursion in the Integrated Language Environment (ILE) compiler. An authenticated attacker could exploit this vulnerability by compiling specially crafted source code containing a specific combination of statements.

CVE-2026-44844 is a medium severity vulnerability in the GOVCERT-LU eml_parser Python module prior to version 3.0.1. The vulnerability arises from uncontrolled recursion in the get_raw_body_text() function, which recurses without depth limits on nested message/rfc822 attachments. An attacker supplying a crafted EML file with about 120 nested parts can trigger a RecursionError, causing the parser to crash. The exploit requires a non-RFC-compliant EML file, making it an unlikely scenario. This issue is fixed in version 3.0.1.

A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack Exhaustion vulnerability, leading to a denial-of-service condition.

CVE-2026-47317 is an uncontrolled recursion vulnerability in Samsung Open Source Escargot that can lead to excessive memory allocation. The vulnerability affects a specific version of Escargot identified by commit 590345cc6258317c5da850d846ce6baaf2afc2d3. It has a medium severity rating with a CVSS score of 5.5, indicating a moderate impact primarily on availability. There is no vendor-provided patch or official remediation guidance available at this time. No known exploits are reported in the wild. The vulnerability requires local access with user interaction to be triggered. No confidentiality or integrity impacts are noted.

CVE-2026-47309 is an uncontrolled recursion vulnerability in Samsung Open Source Escargot that allows oversized serialized data payloads. This flaw can cause a denial of service by exhausting system resources due to recursive processing. The vulnerability affects a specific Escargot version identified by commit 590345cc6258317c5da850d846ce6baaf2afc2d3. There is no official patch or remediation level provided at this time. The CVSS score is 5.5, indicating a medium severity impact focused on availability. No known exploits are reported in the wild, and the product is not a cloud service. No geographic targeting is indicated.

Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.

An uncontrolled recursion vulnerability exists in Apache Commons Configuration when processing YAML configuration files containing cycles. This can cause a StackOverflowError, leading to a denial of service. The issue affects versions from 2.2 up to but not including 2.15.0. Upgrading to version 2.15.0 resolves the problem.

protobuf.js versions prior to 7.5.8 and between 8.0.0 and before 8.2.0 have an uncontrolled recursion vulnerability in the handling of nested JSON descriptors. This can cause the JavaScript call stack to be exhausted, leading to a denial of service during descriptor loading. The issue arises from the Root.

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf binary payload could cause the JavaScript call stack to be exhausted during decoding. This vulnerability is fixed in 7.5.6 and 8.0.2.

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image parser in NanaZip. The function GetAllPaths recurses into subdirectories without any depth limit or visited-inode tracking. A crafted UFS image with a deep directory tree or an inode cycle causes stack exhaustion, crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllPaths function recurse without depth limits, exhausting the thread stack and crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.

CVE-2026-44777 is a medium severity vulnerability in the jq command-line JSON processor (version 1.8.2rc1 and earlier). The issue involves uncontrolled recursion in the ordinary module loader when two valid modules include each other, causing recursion without cycle detection. This can lead to potential denial of service or resource exhaustion. No official patch or remediation guidance is currently available from the vendor. Users should monitor vendor advisories for updates and avoid using mutually recursive modules until a fix is provided.

CVE-2026-43896 is a medium severity vulnerability in jq versions 1.8.1 and earlier caused by uncontrolled recursion in the jv_object_merge_recursive() function. This occurs when using the * operator on two JSON objects, potentially causing a segmentation fault and crashing the jq process. The vulnerability impacts availability but does not affect confidentiality or integrity. No official patch or remediation is currently available. Users should monitor vendor advisories for updates and exercise caution when processing untrusted JSON with affected jq versions.

CVE-2026-40612 is a medium severity vulnerability in jq (version 1.8.1 and earlier) where the function jv_contains performs uncontrolled recursion into nested JSON arrays or objects without a depth limit. This can lead to exhaustion of the C stack when processing sufficiently deeply nested input structures, causing a denial of service. The vulnerability arises because jq's JSON parser limits nesting depth to 10,000, but programmatically constructed inputs using reduce can exceed this, triggering the recursion issue.