Monthly
Denial of service in kin-openapi before 0.149.0 allows unauthenticated remote attackers to terminate the entire Go process by triggering unbounded recursion during runtime schema validation. When a loaded OpenAPI document contains an allOf, anyOf, or oneOf chain that refers back to an ancestor schema - a circular reference the loader and document validation accept without error - a request or response that reaches that schema causes Schema.visitJSON or openapi3filter.decodeValue to recurse until the goroutine stack is exhausted; the resulting fatal stack overflow cannot be caught with recover and aborts the whole process, including unrelated in-flight requests. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), driven entirely by availability with no confidentiality or integrity impact; the key limiting factor is that a vulnerable circular schema must already exist in the deployed spec, so default non-circular specs are unaffected. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the issue is fixed in version 0.149.0.
Denial of service in Symfony's ExpressionLanguage component lets a remote, unauthenticated attacker crash the PHP process by submitting a single expression built from tens of thousands of nested unary operators, array/hash literals, binary operators, property accesses or ternaries. The parser places no bound on the depth of the node tree it builds, and when that tree is destroyed PHP's recursive free overflows the native stack; the crash occurs while the tree is being freed, so it happens even if the expression itself would never be evaluated. Symfony applications that lint user-supplied expressions - most directly through the #[Assert\ExpressionSyntax] validator, which forwards the validated value to ExpressionLanguage::lint(), or any code calling parse()/lint() on untrusted input - are affected in versions up to 5.4.53, 6.4.47, 7.4.20 and 8.1.8. Impact is availability-only (CVSS:4.0 base 8.7 per NVD; our independent CVSS:3.1 assessment scores it AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), there is no data exposure or code execution, no public exploit code has been identified at time of analysis, and vendor patches are available.
Unbounded recursion in the Symfony YAML inline lexer lets a single document made of deeply nested inline collections (for example [[[[...]]]] or {{{...'}) exhaust the PHP call stack, crashing the worker process or ending the request with a fatal error in symfony/yaml prior to 5.4.54, 6.4.45, 7.4.18, and 8.1.6. The highest-exposure path is fully unauthenticated: a controller using #[MapRequestPayload] with the Yaml component installed and no acceptFormat restriction will accept a YAML content-type request that reaches Parser::lexInlineStructure() directly, and any application that parses untrusted YAML is affected. Impact is availability-only per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.7), exploitation is bounded by whether attacker-controlled input ever reaches the parser and by PHP version and stack settings. Vendor-released fixes exist for all maintained branches and no public exploit identified at time of analysis.
Unauthenticated remote denial of service in FasterXML Jackson 1.x (jackson-mapper-asl 1.8.3 and 1.9.2-1.9.13) allows an attacker to crash or exhaust the stack of an application that deserializes untrusted JSON via ObjectMapper.readValue by supplying deeply nested input. The flaw is CWE-674 uncontrolled recursion: the Jackson 1.x parser performs recursive descent without a configurable nesting-depth limit. No public exploit code identified at time of analysis, and Jackson 2.x deployments are unaffected because that branch enforces StreamReadConstraints depth limits by default.
Denial of service in lottie-android 6.7.1 and earlier allows remote attackers to crash or hang applications by supplying a crafted Lottie animation JSON that contains a cyclic precomposition reference graph, which triggers uncontrolled recursion during layer model construction in BaseLayer.forModel and CompositionLayer. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms unauthenticated, network-reachable availability impact with no confidentiality or integrity effect. No CISA KEV entry or public exploit code has been identified at time of analysis, but exploitation requires the host application to parse untrusted or remote Lottie files; applications rendering only bundled, trusted animations are not exposed.
Denial of service in Microsoft .NET and .NET Framework stems from uncontrolled recursion (CWE-674) in the System.Security.Cryptography.Xml and System.Private.Xml libraries, which an unauthenticated remote attacker can trigger by supplying crafted signed or encrypted XML that the target application parses. Affected runtimes include .NET 8.0 before 8.0.32, .NET 9.0 before 9.0.21, .NET 10.0 before 10.0.13, .NET 11.0 before 11.0.0-rc.2, and multiple .NET Framework builds (3.5 through 4.8.1) shipped on Windows, Linux and macOS, plus Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4. Impact is limited to availability (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 7.5) - process crash or hang, with no data exposure or code execution; CISA's SSVC assessment rates exploitation as 'none' meaning no public exploit identified at time of analysis, and exploitation is only practical against services that actually invoke XML signature or encryption validation on untrusted input.
Denial of service in IBM Maximo AI Service 9.1.0 and 9.2.0 SaaS allows remote unauthenticated attackers to trigger uncontrolled recursion in an exposed processing path, causing availability impact. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so no privileges or user interaction are required and only availability is affected; no public exploit identified at time of analysis. IBM has released a vendor patch via its support advisory for the identified service levels, and because the product is SaaS, IBM controls the deployed instance and its patching.
Denial of service in the IBM Maximo Application Suite IoT Component (versions 9.0.0, 9.1.0, and 9.2.0) allows a remote, unauthenticated attacker to exhaust or crash the service by triggering uncontrolled recursion in its input parsing/processing logic. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials or user interaction are required against a network-reachable instance, but the impact is strictly availability - there is no confidentiality or integrity effect. At the time of analysis there is no public exploit identified, and the vendor has released a fix via its support portal.
Unauthenticated remote denial of service in the OWASP Coraza WAF Go library (versions 3.0.0 through 3.8.0) allows any client that can deliver a JSON request or response body to crash the entire hosting process with an unrecoverable fatal stack overflow. The flaw is reachable with default configuration - the payload stays under the recommended SecRequestBodyLimit and within the default SecArgumentsLimit of 1000 - because the body processor's bounded flattening walk stops early on argument truncation and then unconditionally hands the complete raw body to gjson.Valid, which recurses once per nesting level with no depth bound and cannot be intercepted by recover(). Impact is availability only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-674); no public exploit code identified at time of analysis and no KEV listing, though the vendor advisory documents a working repro payload of roughly 13 MB.
Memory-exhaustion denial of service in the elixir-protobuf library (protobuf) from 0.8.0 onward allows an unauthenticated remote attacker to crash an Elixir decoding process by supplying a deeply nested JSON document through Protobuf.JSON.decode/3, decode!/3, or from_decoded/3 when the target schema contains a self-referential or cyclic message type. Because the embedded-message clause of decode_singular/3 recurses once per nesting level without touching the decoder's depth counter, the recursion_limit option offers no protection and each level consumes a stack frame plus heap objects until the process runs out of memory; confidentiality and integrity are unaffected, only availability. Exploitation is unauthenticated and requires no user interaction, but is limited to applications that decode untrusted JSON into recursive message definitions, and no public exploit code has been identified at time of analysis (EPSS data not provided).
Denial of service in kin-openapi before 0.149.0 allows unauthenticated remote attackers to terminate the entire Go process by triggering unbounded recursion during runtime schema validation. When a loaded OpenAPI document contains an allOf, anyOf, or oneOf chain that refers back to an ancestor schema - a circular reference the loader and document validation accept without error - a request or response that reaches that schema causes Schema.visitJSON or openapi3filter.decodeValue to recurse until the goroutine stack is exhausted; the resulting fatal stack overflow cannot be caught with recover and aborts the whole process, including unrelated in-flight requests. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), driven entirely by availability with no confidentiality or integrity impact; the key limiting factor is that a vulnerable circular schema must already exist in the deployed spec, so default non-circular specs are unaffected. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the issue is fixed in version 0.149.0.
Denial of service in Symfony's ExpressionLanguage component lets a remote, unauthenticated attacker crash the PHP process by submitting a single expression built from tens of thousands of nested unary operators, array/hash literals, binary operators, property accesses or ternaries. The parser places no bound on the depth of the node tree it builds, and when that tree is destroyed PHP's recursive free overflows the native stack; the crash occurs while the tree is being freed, so it happens even if the expression itself would never be evaluated. Symfony applications that lint user-supplied expressions - most directly through the #[Assert\ExpressionSyntax] validator, which forwards the validated value to ExpressionLanguage::lint(), or any code calling parse()/lint() on untrusted input - are affected in versions up to 5.4.53, 6.4.47, 7.4.20 and 8.1.8. Impact is availability-only (CVSS:4.0 base 8.7 per NVD; our independent CVSS:3.1 assessment scores it AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), there is no data exposure or code execution, no public exploit code has been identified at time of analysis, and vendor patches are available.
Unbounded recursion in the Symfony YAML inline lexer lets a single document made of deeply nested inline collections (for example [[[[...]]]] or {{{...'}) exhaust the PHP call stack, crashing the worker process or ending the request with a fatal error in symfony/yaml prior to 5.4.54, 6.4.45, 7.4.18, and 8.1.6. The highest-exposure path is fully unauthenticated: a controller using #[MapRequestPayload] with the Yaml component installed and no acceptFormat restriction will accept a YAML content-type request that reaches Parser::lexInlineStructure() directly, and any application that parses untrusted YAML is affected. Impact is availability-only per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.7), exploitation is bounded by whether attacker-controlled input ever reaches the parser and by PHP version and stack settings. Vendor-released fixes exist for all maintained branches and no public exploit identified at time of analysis.
Unauthenticated remote denial of service in FasterXML Jackson 1.x (jackson-mapper-asl 1.8.3 and 1.9.2-1.9.13) allows an attacker to crash or exhaust the stack of an application that deserializes untrusted JSON via ObjectMapper.readValue by supplying deeply nested input. The flaw is CWE-674 uncontrolled recursion: the Jackson 1.x parser performs recursive descent without a configurable nesting-depth limit. No public exploit code identified at time of analysis, and Jackson 2.x deployments are unaffected because that branch enforces StreamReadConstraints depth limits by default.
Denial of service in lottie-android 6.7.1 and earlier allows remote attackers to crash or hang applications by supplying a crafted Lottie animation JSON that contains a cyclic precomposition reference graph, which triggers uncontrolled recursion during layer model construction in BaseLayer.forModel and CompositionLayer. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms unauthenticated, network-reachable availability impact with no confidentiality or integrity effect. No CISA KEV entry or public exploit code has been identified at time of analysis, but exploitation requires the host application to parse untrusted or remote Lottie files; applications rendering only bundled, trusted animations are not exposed.
Denial of service in Microsoft .NET and .NET Framework stems from uncontrolled recursion (CWE-674) in the System.Security.Cryptography.Xml and System.Private.Xml libraries, which an unauthenticated remote attacker can trigger by supplying crafted signed or encrypted XML that the target application parses. Affected runtimes include .NET 8.0 before 8.0.32, .NET 9.0 before 9.0.21, .NET 10.0 before 10.0.13, .NET 11.0 before 11.0.0-rc.2, and multiple .NET Framework builds (3.5 through 4.8.1) shipped on Windows, Linux and macOS, plus Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4. Impact is limited to availability (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 7.5) - process crash or hang, with no data exposure or code execution; CISA's SSVC assessment rates exploitation as 'none' meaning no public exploit identified at time of analysis, and exploitation is only practical against services that actually invoke XML signature or encryption validation on untrusted input.
Denial of service in IBM Maximo AI Service 9.1.0 and 9.2.0 SaaS allows remote unauthenticated attackers to trigger uncontrolled recursion in an exposed processing path, causing availability impact. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so no privileges or user interaction are required and only availability is affected; no public exploit identified at time of analysis. IBM has released a vendor patch via its support advisory for the identified service levels, and because the product is SaaS, IBM controls the deployed instance and its patching.
Denial of service in the IBM Maximo Application Suite IoT Component (versions 9.0.0, 9.1.0, and 9.2.0) allows a remote, unauthenticated attacker to exhaust or crash the service by triggering uncontrolled recursion in its input parsing/processing logic. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials or user interaction are required against a network-reachable instance, but the impact is strictly availability - there is no confidentiality or integrity effect. At the time of analysis there is no public exploit identified, and the vendor has released a fix via its support portal.
Unauthenticated remote denial of service in the OWASP Coraza WAF Go library (versions 3.0.0 through 3.8.0) allows any client that can deliver a JSON request or response body to crash the entire hosting process with an unrecoverable fatal stack overflow. The flaw is reachable with default configuration - the payload stays under the recommended SecRequestBodyLimit and within the default SecArgumentsLimit of 1000 - because the body processor's bounded flattening walk stops early on argument truncation and then unconditionally hands the complete raw body to gjson.Valid, which recurses once per nesting level with no depth bound and cannot be intercepted by recover(). Impact is availability only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-674); no public exploit code identified at time of analysis and no KEV listing, though the vendor advisory documents a working repro payload of roughly 13 MB.
Memory-exhaustion denial of service in the elixir-protobuf library (protobuf) from 0.8.0 onward allows an unauthenticated remote attacker to crash an Elixir decoding process by supplying a deeply nested JSON document through Protobuf.JSON.decode/3, decode!/3, or from_decoded/3 when the target schema contains a self-referential or cyclic message type. Because the embedded-message clause of decode_singular/3 recurses once per nesting level without touching the decoder's depth counter, the recursion_limit option offers no protection and each level consumes a stack frame plus heap objects until the process runs out of memory; confidentiality and integrity are unaffected, only availability. Exploitation is unauthenticated and requires no user interaction, but is limited to applications that decode untrusted JSON into recursive message definitions, and no public exploit code has been identified at time of analysis (EPSS data not provided).