CVE-2026-123660 affects vulnerability-lookup versions 5.5.1 up to but not including 6.4.1. A signed-in user can craft webhook notification payload templates that cause excessive memory allocation during string formatting, leading to potential denial of service. The vulnerability arises because format specifiers in placeholders are passed unchecked to Python's string formatting, allowing very large memory allocations. Version 6.4.1 fixes this by capping format specifier numbers, limiting rendered template size, and restricting template nesting depth.
LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entries the page could hold, which comes from a different field of the index header. A crafted index could also make a page refer back to itself, so that reading it recursed without end. In fixed versions the index header and the entry count of each page are limited to what an index page can hold, and a page that refers back to one of its parent pages is not followed.
ESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the `mdns` component follows DNS name-compression pointers recursively when parsing fully qualified domain names (FQDNs) in inbound mDNS packets without capping pointer-follow depth in `mdns_utils_read_fqdn()`. An unauthenticated attacker on the same link-local network can send a crafted packet to UDP port 5353 on an `ESP-IDF` device using `espressif/mdns` with mDNS enabled. Deep recursion exhausts the fixed-size stack of the mDNS FreeRTOS task, causing a controlled panic and reboot; persistent malicious traffic can cause a crash loop. No confidentiality or integrity impact has been demonstrated, and remote code execution is not claimed. This issue is fixed in mDNS version 1.11.2.
vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) handlers and kills the reading thread. A Vault token that can write but not read a KV v2 path can store such a value there, so every later read of that path through the driver fails. This requires Vault 1.19.x or earlier, because 1.20 and later reject values nested deeper than 298 levels. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3 and is fixed in 7.0.0.
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6.
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.
Uncontrolled Recursion vulnerability in Apache Thrift Java bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
CVE-2026-62303 is a medium severity vulnerability in the pistache C++ REST toolkit versions 0.0.5 through 0.4.26. It involves uncontrolled resource consumption due to recursive use of std::regex_replace in path normalization, which can exhaust the stack and crash the process when processing very long request paths containing tens of thousands of consecutive slashes. Exploitation requires the deployment to allow unusually long request paths beyond the default 4096-byte limit or attacker control over router API inputs. No official patch release was confirmed at the time of disclosure.
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a `SystemStackError`, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7.
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses `CSS simple blocks and functions` without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises `SystemStackError`: stack level too deep, or cause excessive memory usage. Version 1.0.7 adds a configurable depth limit with a conservative default. This issue is fixed in version 1.0.7.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used asn1.fromDer(), BIT STRING decoding, maxDepth to process the relevant input or security decision. node-forge decoded ASN.1 stored inside BIT STRING values without consistently applying the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer(). This issue is fixed in version 1.4.1.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(), TLS record processing, process() to process the relevant input or security decision. node-forge processed received TLS records recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service. This issue is fixed in version 1.4.1.
A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.
CVE-2026-118037 is a high-severity vulnerability in Progress Software's Telerik Document Processing Libraries prior to version 2026.3.1027. It involves uncontrolled recursion, infinite loops, unchecked loop conditions, and inefficient regular expressions in the RadSpreadProcessing and RadSpreadStreamProcessing components. An unauthenticated attacker can exploit this by crafting malicious XLSX or XLS workbooks or formulas, causing the host process to hang or crash. The issue is fixed in version 2026.3.1027.
CVE-2026-118036 is a high-severity vulnerability in Progress Software's Telerik Document Processing Libraries prior to version 2026.3.1027. It involves uncontrolled recursion and inefficient algorithmic complexity in RadPdfProcessing and AI document summarization and question answering features. An unauthenticated attacker can exploit this by submitting crafted PDF documents or document text, causing the host process to hang or terminate. The issue is fixed in version 2026.3.1027.
CVE-2026-118035 is a high-severity vulnerability in Progress Software's Telerik Document Processing Libraries before version 2026.3.1027. It involves uncontrolled recursion and infinite loop issues in the RadWordsProcessing component. An unauthenticated attacker can exploit this by sending malicious DOCX, DOC, RTF, or HTML documents, causing the host process to hang or crash.
A vulnerability in go-jose prior to version 4.1.5 allows an attacker to cause uncontrolled recursion when parsing deeply nested JSON arrays or objects. This leads to a stack overflow that crashes the application, resulting in a denial of service. The issue is fixed in version 4.1.5.
CVE-2026-65628 is a vulnerability in the potatosalad jose library affecting versions from 1.5.0 up to but not including 1.11.13. It involves uncontrolled recursion in the function jose_jwk:shared_secret/2 when deriving an ECDH shared secret from two JWKs of differing key types. An attacker can supply a malicious JWK with a mismatched key type to cause an unbounded tail-recursive loop, resulting in 100% CPU usage on an Erlang scheduler and potential denial of service through resource exhaustion. The issue is fixed in version 1.11.13.