Monthly
Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises "misplaced or corrupt TSIG", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped. The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response. Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.
Uncontrolled recursion in llama.cpp's JSON-schema-to-grammar converter (common/json-schema-to-grammar.cpp, versions through build b5693) allows a remote unauthenticated attacker to crash the service by submitting a crafted JSON schema that triggers unbounded recursive processing, exhausting the call stack and producing a denial of service. The CVSS vector confirms network reachability with no authentication required and no user interaction needed, making this exploitable against any deployment that exposes the llama.cpp HTTP server endpoint to untrusted clients. No public exploit identified at time of analysis.
Uncontrolled recursion in Samsung's rlottie animation library crashes any application embedding it when processing a crafted Lottie animation file containing pathologically nested shape-group structures. The flaw resides in lottieparser.cpp's parseGroupObject() function, which processed nested shape groups recursively without any depth ceiling, enabling stack exhaustion via a malicious .lottie/.json file. No active exploitation is confirmed and no public exploit has been identified at time of analysis; this is a local, user-interaction-dependent denial-of-service vulnerability.
Uncontrolled recursion in BBEdit's Java Language Module (versions through 15.5.5) allows a remote attacker to crash or hang the editor by delivering a specially crafted Java source file that a user then opens. The root cause is CWE-674: the Java parser lacks depth-limiting guards, enabling deeply nested constructs to exhaust the call stack and produce a denial-of-service against the editor process. No active exploitation has been recorded and no public proof-of-concept exploit code is known; the issue was surfaced through fuzzing research by Cipher Security Labs, and Bare Bones Software has released a fix in BBEdit 16.0.
Uncontrolled recursion in ash_oban's compile-time-generated Oban worker code enables unbounded heap growth and CPU exhaustion in the BEAM worker process when a trigger's on_error action deterministically raises on the job's final attempt. Affected versions span 0.8.0-rc.1 through 0.8.13 of the ash-project/ash_oban Elixir library. Any condition that causes the on_error action to fail repeatedly - a data-layer outage, a misconfigured action, or a record the action validates and rejects - loops handle_error/4 forever, growing the process heap without bound until the BEAM runtime kills the worker. No public exploit has been identified at time of analysis; a vendor-released patch is confirmed at 0.8.14.
Uncontrolled recursion between Elixir's charlist inspection path and the error-message rescue clause in List.to_string/1 and List.to_charlist/1 can exhaust a BEAM node's memory when an attacker controls list data reaching those functions. A crafted list whose printable prefix exceeds the 4096-element printable_limit but which carries an invalid element beyond that threshold bypasses the ASCII classification check, triggers ArgumentError in IO.chardata_to_string/1, and then recurses infinitely through the rescue clause because the inner inspect/1 call is not in tail position - every frame is retained on the process heap. No public exploit has been identified at time of analysis; vendor-released patches are available as Elixir 1.18.5, 1.19.6, and 1.20.4.
Stack exhaustion via crafted compressed IMAP data in OX Dovecot Pro and OX Dovecot CE allows an authenticated remote attacker to crash the IMAP process, causing denial of service. The flaw (CWE-674, Uncontrolled Recursion) is triggered by sending specially constructed compressed payloads that exceed stack depth limits during decompression processing. No public exploit code exists, and exploitation requires valid IMAP credentials, meaningfully limiting the attacker pool.
Uncontrolled recursion in NLTK's FeatStructReader component (all versions before 3.10.3) enables unauthenticated remote attackers to crash any Python application that parses user-supplied feature structures or feature grammars. Attackers submit trivially crafted payloads containing deeply nested brackets, exhausting Python's call stack and raising an unhandled RecursionError that terminates the application process. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; a vendor patch is available in NLTK 3.10.3.
Denial of service in Spring AI's PDF document ingestion crashes the processing thread when parsing a crafted PDF with a deeply nested or cyclic table of contents structure. Affected versions span the 1.0.x and 1.1.x release lines as well as the 2.0.0 release. An unauthenticated remote attacker who can supply a malicious PDF to an application's ingestion pipeline can trigger a StackOverflowError, halting document processing availability with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Uncontrolled recursion in Autodesk 3ds Max's SVG parser allows a crafted file to exhaust the call stack and crash the application, resulting in denial of service. The attack requires user interaction - a victim must open a maliciously crafted SVG file - and has no impact on confidentiality or integrity. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises "misplaced or corrupt TSIG", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped. The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response. Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.
Uncontrolled recursion in llama.cpp's JSON-schema-to-grammar converter (common/json-schema-to-grammar.cpp, versions through build b5693) allows a remote unauthenticated attacker to crash the service by submitting a crafted JSON schema that triggers unbounded recursive processing, exhausting the call stack and producing a denial of service. The CVSS vector confirms network reachability with no authentication required and no user interaction needed, making this exploitable against any deployment that exposes the llama.cpp HTTP server endpoint to untrusted clients. No public exploit identified at time of analysis.
Uncontrolled recursion in Samsung's rlottie animation library crashes any application embedding it when processing a crafted Lottie animation file containing pathologically nested shape-group structures. The flaw resides in lottieparser.cpp's parseGroupObject() function, which processed nested shape groups recursively without any depth ceiling, enabling stack exhaustion via a malicious .lottie/.json file. No active exploitation is confirmed and no public exploit has been identified at time of analysis; this is a local, user-interaction-dependent denial-of-service vulnerability.
Uncontrolled recursion in BBEdit's Java Language Module (versions through 15.5.5) allows a remote attacker to crash or hang the editor by delivering a specially crafted Java source file that a user then opens. The root cause is CWE-674: the Java parser lacks depth-limiting guards, enabling deeply nested constructs to exhaust the call stack and produce a denial-of-service against the editor process. No active exploitation has been recorded and no public proof-of-concept exploit code is known; the issue was surfaced through fuzzing research by Cipher Security Labs, and Bare Bones Software has released a fix in BBEdit 16.0.
Uncontrolled recursion in ash_oban's compile-time-generated Oban worker code enables unbounded heap growth and CPU exhaustion in the BEAM worker process when a trigger's on_error action deterministically raises on the job's final attempt. Affected versions span 0.8.0-rc.1 through 0.8.13 of the ash-project/ash_oban Elixir library. Any condition that causes the on_error action to fail repeatedly - a data-layer outage, a misconfigured action, or a record the action validates and rejects - loops handle_error/4 forever, growing the process heap without bound until the BEAM runtime kills the worker. No public exploit has been identified at time of analysis; a vendor-released patch is confirmed at 0.8.14.
Uncontrolled recursion between Elixir's charlist inspection path and the error-message rescue clause in List.to_string/1 and List.to_charlist/1 can exhaust a BEAM node's memory when an attacker controls list data reaching those functions. A crafted list whose printable prefix exceeds the 4096-element printable_limit but which carries an invalid element beyond that threshold bypasses the ASCII classification check, triggers ArgumentError in IO.chardata_to_string/1, and then recurses infinitely through the rescue clause because the inner inspect/1 call is not in tail position - every frame is retained on the process heap. No public exploit has been identified at time of analysis; vendor-released patches are available as Elixir 1.18.5, 1.19.6, and 1.20.4.
Stack exhaustion via crafted compressed IMAP data in OX Dovecot Pro and OX Dovecot CE allows an authenticated remote attacker to crash the IMAP process, causing denial of service. The flaw (CWE-674, Uncontrolled Recursion) is triggered by sending specially constructed compressed payloads that exceed stack depth limits during decompression processing. No public exploit code exists, and exploitation requires valid IMAP credentials, meaningfully limiting the attacker pool.
Uncontrolled recursion in NLTK's FeatStructReader component (all versions before 3.10.3) enables unauthenticated remote attackers to crash any Python application that parses user-supplied feature structures or feature grammars. Attackers submit trivially crafted payloads containing deeply nested brackets, exhausting Python's call stack and raising an unhandled RecursionError that terminates the application process. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; a vendor patch is available in NLTK 3.10.3.
Denial of service in Spring AI's PDF document ingestion crashes the processing thread when parsing a crafted PDF with a deeply nested or cyclic table of contents structure. Affected versions span the 1.0.x and 1.1.x release lines as well as the 2.0.0 release. An unauthenticated remote attacker who can supply a malicious PDF to an application's ingestion pipeline can trigger a StackOverflowError, halting document processing availability with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Uncontrolled recursion in Autodesk 3ds Max's SVG parser allows a crafted file to exhaust the call stack and crash the application, resulting in denial of service. The attack requires user interaction - a victim must open a maliciously crafted SVG file - and has no impact on confidentiality or integrity. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.