NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion
CVE-2026-81724
NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unau
#cwe-674
共收录 308 条相关情报。
← 返回所有主题Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 ...
CVE-2026-47851
Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread.
ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal do...
CVE-2026-55588
ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to
A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can trigger an Uncontrolled...
CVE-2026-16781
A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can trigger an Uncontrolled Recursion vulnerabilit
A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to c...
CVE-2026-16781
A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can trigger an Uncontrolled Recursion vulnerabilit
Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply ne...
CVE-2026-76098
Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS throu
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
CVE-2026-54623
### Summary The `move_plugin` admin endpoint does not prevent a plugin from being reparented under itself or one of it
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to...
CVE-2026-9769
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During Ju
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditional...
CVE-2026-9769
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During Ju
NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply ne...
CVE-2026-66393
NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows at
RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nestin...
CVE-2026-53531
RaTeX 是一个用 Rust 编写的、与 KaTeX 兼容的数学渲染引擎。在 0.1.11 版本之前，其递归下降解析器在处理嵌套结构（如 `{`、`\left`、`\sqrt{`、`^{` 等）时，每嵌套一层就会消耗一个或多个原生栈帧，且
Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw...
CVE-2026-63462
Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation e
Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter
CVE-2026-63462
## Summary An unauthenticated `POST` to any OpenAPI-validated endpoint, including the anonymous `POST /edge/validate` a
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmi...
CVE-2026-54623
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0
deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeI...
CVE-2026-40345
deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the
In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault.
CVE-2026-16440
In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault.
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/V...
CVE-2026-69220
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes.
docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service
CVE-2026-53752
### Summary docx4j's `PropertyResolver` and several adjacent helpers recursively walk the OpenXML style inheritance chai
Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent...
CVE-2026-74795
Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does n
Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the...
CVE-2026-74794
Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit prop