Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Exc...

CVE-2026-102409

Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an El

历史摘要 · 未重新核验 · NVD

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

CVE-2026-18140

### Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smith

历史摘要 · 未重新核验 · GitHub Advisory

Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, wh...

CVE-2026-96289

Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0.

历史摘要 · 未重新核验 · NVD

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, rea...

CVE-2026-83663

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffere

历史摘要 · 未重新核验 · NVD

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the sta...

CVE-2026-66858

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message th

历史摘要 · 未重新核验 · NVD

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. ...

CVE-2026-96288

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindi

历史摘要 · 未重新核验 · NVD

Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0,...

CVE-2026-94650

Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.

历史摘要 · 未重新核验 · NVD

Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to versi...

CVE-2026-85493

Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: be

历史摘要 · 未重新核验 · NVD

Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacke...

CVE-2026-103600

Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Legion of the Bouncy Castle Inc. bc-cs

历史摘要 · 未重新核验 · NVD

Unbounded ASN.1 nesting depth causes process-terminating stack overflow

CVE-2026-103600

Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Legion of the Bouncy Castle Inc. bc-cs

历史摘要 · 未重新核验 · OSV.dev

Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a...

CVE-2026-104020

Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor t

历史摘要 · 未重新核验 · NVD

Uncontrolled recursion in the Ion reader in Amazon Ion Python

CVE-2026-104020

Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor t

历史摘要 · 未重新核验 · OSV.dev

Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before...

CVE-2026-103087

Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a

历史摘要 · 未重新核验 · GitHub Advisory

Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service (stack exhau...

CVE-2026-103087

Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a

历史摘要 · 未重新核验 · NVD

Nest: Remote process termination via a deeply nested microservice message pattern

CVE-2026-102281

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | `@nestjs/microservices` | | Affected versions | `>= 12.0

历史摘要 · 未重新核验 · GitHub Advisory

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

CVE-2026-102278

### Summary `expand_()` recurses once per level of brace *nesting*. Deeply nested input exhausts the native stack and c

历史摘要 · 未重新核验 · GitHub Advisory

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

CVE-2026-102276

### Summary `parseCommaParts()` can exhaust the native stack and crash the process. There are two distinct ways to trig

历史摘要 · 未重新核验 · GitHub Advisory

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

CVE-2026-102265

## Package pyjwt (PyPI) ## Affected versions tested & verified on: 2.13.0. Every version whose `PyJWS._load()` transl

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

## Submission metadata | Field | Value | |---|---| | Ecosystem | npm | | Package | `nodemailer` | | Repository | https:

历史摘要 · 未重新核验 · GitHub Advisory

The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cy...

CVE-2026-102497

The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model grou

历史摘要 · 未重新核验 · NVD