Common Weakness Enumeration
CWE-674
Allowed-with-ReviewUncontrolled Recursion
Abstraction: Class · Status: Draft
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
740 vulnerabilities reference this CWE, most recent first.
CVE-2026-82797 (GCVE-0-2026-82797)
Vulnerability from cvelistv5 – Published: 2026-08-31 11:28 – Updated: 2026-08-31 14:27
VLAI
EPSS
VEX
Summary
Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads.
This issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 14:27 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Samsung Open Source | rlottie |
Affected:
0 , < 8de0d9e6ca80ffef654965505981727b9fa06a51
(git)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82797",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T14:27:09.436917Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T14:27:19.437Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "rlottie",
"vendor": "Samsung Open Source",
"versions": [
{
"lessThan": "8de0d9e6ca80ffef654965505981727b9fa06a51",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Fatullayev Asadbek"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads.\u003cp\u003eThis issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51.\u003c/p\u003e"
}
],
"value": "Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads.\n\nThis issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51."
}
],
"impacts": [
{
"capecId": "CAPEC-230",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-230 Serialized Data with Nested Payloads"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T11:31:21.533Z",
"orgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
"shortName": "samsung.tv_appliance"
},
"references": [
{
"url": "https://github.com/Samsung/rlottie/pull/603"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca193ba2-0cff-4e34-b04e-1ea07103c6fe",
"assignerShortName": "samsung.tv_appliance",
"cveId": "CVE-2026-82797",
"datePublished": "2026-08-31T11:28:08.147Z",
"dateReserved": "2026-08-31T02:32:29.811Z",
"dateUpdated": "2026-08-31T14:27:19.437Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82604 (GCVE-0-2026-82604)
Vulnerability from cvelistv5 – Published: 2026-08-31 02:00 – Updated: 2026-08-31 16:10
VLAI
EPSS
VEX
Title
BareBones BBEdit Java Language recursion
Summary
A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontrolled recursion. Remote exploitation of the attack is possible. Upgrading to version 16.0 is recommended to address this issue. You should upgrade the affected component.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:10 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/397106 | vdb-entry |
| https://vuldb.com/vuln/397106/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-82604 | third-party-advisory |
| https://vuldb.com/submit/892839 | third-party-advisory |
| https://ciphersecuritylabs.com/research/articles/… | related |
| https://www.barebones.com/support/bbedit/notes-16… | related |
| https://www.barebones.com/store/bbedit_upgrades.html | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82604",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:10:35.917124Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T16:10:48.833Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:barebones:bbedit:*:*:*:*:*:*:*:*"
],
"modules": [
"Java Language Module"
],
"product": "BBEdit",
"vendor": "BareBones",
"versions": [
{
"status": "affected",
"version": "15.5.0"
},
{
"status": "affected",
"version": "15.5.1"
},
{
"status": "affected",
"version": "15.5.2"
},
{
"status": "affected",
"version": "15.5.3"
},
{
"status": "affected",
"version": "15.5.4"
},
{
"status": "affected",
"version": "15.5.5"
},
{
"status": "unaffected",
"version": "16.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ciphersecuritylabs (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontrolled recursion. Remote exploitation of the attack is possible. Upgrading to version 16.0 is recommended to address this issue. You should upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:00:13.384Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-397106 | BareBones BBEdit Java Language recursion",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/397106"
},
{
"name": "VDB-397106 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/397106/cti"
},
{
"name": "CVE-2026-82604 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-82604"
},
{
"name": "Submit #892839 | BareBones BBEdit 15.5.5 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/892839"
},
{
"tags": [
"related"
],
"url": "https://ciphersecuritylabs.com/research/articles/fuzzing-bbedit-language-modules-stack-exhaustion-and-infinite-loop-dos-bugs"
},
{
"tags": [
"related"
],
"url": "https://www.barebones.com/support/bbedit/notes-16.0.html"
},
{
"tags": [
"patch"
],
"url": "https://www.barebones.com/store/bbedit_upgrades.html"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-30T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-30T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-30T09:19:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "BareBones BBEdit Java Language recursion",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-82604",
"datePublished": "2026-08-31T02:00:13.384Z",
"dateReserved": "2026-08-30T07:14:40.141Z",
"dateUpdated": "2026-08-31T16:10:48.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81724 (GCVE-0-2026-81724)
Vulnerability from cvelistv5 – Published: 2026-08-27 14:51 – Updated: 2026-08-27 18:29
VLAI
EPSS
VEX
Title
NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion
Summary
NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 18:28 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/nltk/nltk/security/advisories/… | vendor-advisory |
| https://www.vulncheck.com/advisories/nltk-before-… | third-party-advisory |
Impacted products
Date Public
2026-08-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81724",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T18:28:30.462220Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T18:29:04.021Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-cw6x-m8jw-qmrh"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/nltk",
"product": "nltk",
"vendor": "nltk",
"versions": [
{
"lessThan": "3.10.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.10.3",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.10.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "JoshgunAbdullayev"
}
],
"datePublic": "2026-08-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python\u0027s recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:51:17.358Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cw6x-m8jw-qmrh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-cw6x-m8jw-qmrh"
},
{
"name": "VulnCheck Advisory: NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nltk-before-3.10.3-denial-of-service-via-uncontrolled-recursion"
}
],
"title": "NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-81724",
"datePublished": "2026-08-27T14:51:17.358Z",
"dateReserved": "2026-08-27T11:15:29.420Z",
"dateUpdated": "2026-08-27T18:29:04.021Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78228 (GCVE-0-2026-78228)
Vulnerability from cvelistv5 – Published: 2026-08-30 11:51 – Updated: 2026-08-31 14:56
VLAI
EPSS
VEX
Title
Unbounded handle_error recursion enables denial of service in AshOban triggers
Summary
Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's on_error action to fail on the final attempt to exhaust worker CPU and memory, denying service.
The generated worker's atomic handle_error/4 runs the trigger's on_error action on a job's final attempt inside a rescue that, when the action itself raises, calls handle_error/4 again with the same job. The job's attempt still equals max_attempts, so it re-enters the same clause and re-runs the failing action, with no exit. Any deterministic on_error failure (a data-layer outage, a misconfigured action, or a record the action rejects) loops forever; because the recursive call is not in tail position, each iteration retains a formatted stacktrace and the process heap grows without bound while the failing statement is re-issued against the data layer until the runtime kills the worker.
This issue affects ash_oban: from 0.8.0-rc.1 before 0.8.14.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 14:55 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_oban/security/… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-78228.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-78228 | related |
| https://github.com/ash-project/ash_oban/commit/85… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_oban |
Affected:
0.8.0-rc.1 , < 0.8.14
(semver)
cpe:2.3:a:ash-project:ash_oban:*:*:*:*:*:*:*:* |
|
| ash-project | ash_oban |
Affected:
5d117ed2006df7277561c69dbfd39281da6ace9f , < 851cd0e76ed882bf736fc48d10f96d037e26b5f0
(git)
cpe:2.3:a:ash-project:ash_oban:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78228",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T14:55:44.685926Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T14:56:07.859Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_oban/security/advisories/GHSA-94p7-498r-mrhp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_oban:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshOban.Transformers.DefineSchedulers\u0027"
],
"packageName": "ash_oban",
"packageURL": "pkg:hex/ash_oban",
"product": "ash_oban",
"programFiles": [
"lib/transformers/define_schedulers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshOban.Transformers.DefineSchedulers\u0027:handle_error/4"
}
],
"repo": "https://github.com/ash-project/ash_oban",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.8.14",
"status": "affected",
"version": "0.8.0-rc.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_oban:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshOban.Transformers.DefineSchedulers\u0027"
],
"packageName": "ash-project/ash_oban",
"packageURL": "pkg:github/ash-project/ash_oban",
"product": "ash_oban",
"programFiles": [
"lib/transformers/define_schedulers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshOban.Transformers.DefineSchedulers\u0027:handle_error/4"
}
],
"repo": "https://github.com/ash-project/ash_oban",
"vendor": "ash-project",
"versions": [
{
"lessThan": "851cd0e76ed882bf736fc48d10f96d037e26b5f0",
"status": "affected",
"version": "5d117ed2006df7277561c69dbfd39281da6ace9f",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA trigger must declare an \u003ccode\u003eon_error\u003c/code\u003e action and run through the atomic worker branch. An attacker needs only to drive that \u003ccode\u003eon_error\u003c/code\u003e action into a deterministic failure (for example by pushing the record into a state the action rejects) and let the job reach its final attempt.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A trigger must declare an `on_error` action and run through the atomic worker branch. An attacker needs only to drive that `on_error` action into a deterministic failure (for example by pushing the record into a state the action rejects) and let the job reach its final attempt."
}
],
"value": "A trigger must declare an on_error action and run through the atomic worker branch. An attacker needs only to drive that on_error action into a deterministic failure (for example by pushing the record into a state the action rejects) and let the job reach its final attempt."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_oban:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.8.14",
"versionStartIncluding": "0.8.0-rc.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger\u0027s \u003ccode\u003eon_error\u003c/code\u003e action to fail on the final attempt to exhaust worker CPU and memory, denying service.\u003c/p\u003e\n\u003cp\u003eThe generated worker\u0027s atomic \u003ccode\u003ehandle_error/4\u003c/code\u003e runs the trigger\u0027s \u003ccode\u003eon_error\u003c/code\u003e action on a job\u0027s final attempt inside a \u003ccode\u003erescue\u003c/code\u003e that, when the action itself raises, calls \u003ccode\u003ehandle_error/4\u003c/code\u003e again with the same job. The job\u0027s \u003ccode\u003eattempt\u003c/code\u003e still equals \u003ccode\u003emax_attempts\u003c/code\u003e, so it re-enters the same clause and re-runs the failing action, with no exit. Any deterministic \u003ccode\u003eon_error\u003c/code\u003e failure (a data-layer outage, a misconfigured action, or a record the action rejects) loops forever; because the recursive call is not in tail position, each iteration retains a formatted stacktrace and the process heap grows without bound while the failing statement is re-issued against the data layer until the runtime kills the worker.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_oban: from 0.8.0-rc.1 before 0.8.14.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger\u0027s `on_error` action to fail on the final attempt to exhaust worker CPU and memory, denying service.\n\nThe generated worker\u0027s atomic `handle_error/4` runs the trigger\u0027s `on_error` action on a job\u0027s final attempt inside a `rescue` that, when the action itself raises, calls `handle_error/4` again with the same job. The job\u0027s `attempt` still equals `max_attempts`, so it re-enters the same clause and re-runs the failing action, with no exit. Any deterministic `on_error` failure (a data-layer outage, a misconfigured action, or a record the action rejects) loops forever; because the recursive call is not in tail position, each iteration retains a formatted stacktrace and the process heap grows without bound while the failing statement is re-issued against the data layer until the runtime kills the worker.\n\nThis issue affects ash_oban: from 0.8.0-rc.1 before 0.8.14."
}
],
"value": "Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger\u0027s on_error action to fail on the final attempt to exhaust worker CPU and memory, denying service.\n\nThe generated worker\u0027s atomic handle_error/4 runs the trigger\u0027s on_error action on a job\u0027s final attempt inside a rescue that, when the action itself raises, calls handle_error/4 again with the same job. The job\u0027s attempt still equals max_attempts, so it re-enters the same clause and re-runs the failing action, with no exit. Any deterministic on_error failure (a data-layer outage, a misconfigured action, or a record the action rejects) loops forever; because the recursive call is not in tail position, each iteration retains a formatted stacktrace and the process heap grows without bound while the failing statement is re-issued against the data layer until the runtime kills the worker.\n\nThis issue affects ash_oban: from 0.8.0-rc.1 before 0.8.14."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-30T11:51:49.621Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_oban/security/advisories/GHSA-94p7-498r-mrhp"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-78228.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-78228"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_oban/commit/851cd0e76ed882bf736fc48d10f96d037e26b5f0"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded handle_error recursion enables denial of service in AshOban triggers"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-78228",
"datePublished": "2026-08-30T11:51:49.621Z",
"dateReserved": "2026-08-30T00:00:01.991Z",
"dateUpdated": "2026-08-31T14:56:07.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76098 (GCVE-0-2026-76098)
Vulnerability from cvelistv5 – Published: 2026-08-24 20:05 – Updated: 2026-08-24 20:17
VLAI
EPSS
VEX
Title
Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
Summary
Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.render_token() can exceed Python's recursion limit and raise RecursionError, allowing crafted Markdown to crash a parsing process. This issue is fixed in version 3.3.3
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 20:16 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/lepture/mistune/security/advis… | x_refsource_CONFIRM |
| https://github.com/lepture/mistune/commit/0938fb7 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76098",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T20:16:30.617465Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T20:17:07.057Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mistune",
"vendor": "lepture",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.3.0, \u003c 3.3.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.render_token() can exceed Python\u0027s recursion limit and raise RecursionError, allowing crafted Markdown to crash a parsing process. This issue is fixed in version 3.3.3"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T20:05:00.932Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq"
},
{
"name": "https://github.com/lepture/mistune/commit/0938fb7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/lepture/mistune/commit/0938fb7"
}
],
"source": {
"advisory": "GHSA-6m44-fpc8-c3rq",
"discovery": "UNKNOWN"
},
"title": "Mistune has Denial of Service \u2014 RecursionError via Excessive Emphasis Markers in Markdown"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-76098",
"datePublished": "2026-08-24T20:05:00.932Z",
"dateReserved": "2026-08-18T21:17:32.201Z",
"dateUpdated": "2026-08-24T20:17:07.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75758 (GCVE-0-2026-75758)
Vulnerability from cvelistv5 – Published: 2026-08-28 11:28 – Updated: 2026-08-28 18:29
VLAI
EPSS
VEX
Title
Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir
Summary
Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node's memory.
Inspect.List's charlist branch in lib/elixir/lib/inspect.ex classifies a list as a charlist using List.ascii_printable?/2, which examines only the first :printable_limit (4096 by default) elements, and then calls IO.chardata_to_string/1 on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises ArgumentError. That conversion runs inside List.to_string/1, whose rescue clause builds its message by interpolating inspect(list), which re-enters the same branch and raises again. The nested inspection is an argument to raise, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by max_heap_size or, by default, the node runs out of memory. List.to_charlist/1 has the same rescue shape.
Below the printable limit the inner inspect/1 sees the invalid element within its counter and renders the list in ordinary bracket form, so a single ArgumentError is raised and no recursion occurs.
This issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 18:28 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-lang | elixir |
Affected:
1.15.0-rc.0 , < 1.18.5
(semver)
Affected: 1.19.0-rc.0 , < 1.19.6 (semver) Affected: 1.20.0-rc.0 , < 1.20.4 (semver) cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:* |
|
| elixir-lang | elixir |
Affected:
9718f2b90ce086ff8614d5782f4ec528495c98dd , < *
(git)
cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75758",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T18:28:19.564474Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T18:29:23.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-jf5q-v438-665c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Inspect.List\u0027",
"\u0027Elixir.List\u0027",
"\u0027Elixir.IO\u0027"
],
"packageName": "elixir",
"packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git",
"product": "elixir",
"programFiles": [
"lib/inspect.ex",
"lib/list.ex",
"lib/io.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Inspect.List\u0027:inspect/2"
},
{
"name": "\u0027Elixir.List\u0027:to_string/1"
},
{
"name": "\u0027Elixir.List\u0027:to_charlist/1"
},
{
"name": "\u0027Elixir.List\u0027:ascii_printable?/2"
},
{
"name": "\u0027Elixir.IO\u0027:chardata_to_string/1"
}
],
"repo": "https://github.com/elixir-lang/elixir",
"vendor": "elixir-lang",
"versions": [
{
"lessThan": "1.18.5",
"status": "affected",
"version": "1.15.0-rc.0",
"versionType": "semver"
},
{
"lessThan": "1.19.6",
"status": "affected",
"version": "1.19.0-rc.0",
"versionType": "semver"
},
{
"lessThan": "1.20.4",
"status": "affected",
"version": "1.20.0-rc.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Inspect.List\u0027",
"\u0027Elixir.List\u0027",
"\u0027Elixir.IO\u0027"
],
"packageName": "elixir-lang/elixir",
"packageURL": "pkg:github/elixir-lang/elixir",
"product": "elixir",
"programFiles": [
"lib/elixir/lib/inspect.ex",
"lib/elixir/lib/list.ex",
"lib/elixir/lib/io.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Inspect.List\u0027:inspect/2"
},
{
"name": "\u0027Elixir.List\u0027:to_string/1"
},
{
"name": "\u0027Elixir.List\u0027:to_charlist/1"
},
{
"name": "\u0027Elixir.List\u0027:ascii_printable?/2"
},
{
"name": "\u0027Elixir.IO\u0027:chardata_to_string/1"
}
],
"repo": "https://github.com/elixir-lang/elixir",
"vendor": "elixir-lang",
"versions": [
{
"changes": [
{
"at": "1eff1acffd49bdcc0d7f57ca74c1603328eed68a",
"status": "unaffected"
},
{
"at": "5230d73968f1b4969d2a2646786fa6c71475f5cc",
"status": "unaffected"
},
{
"at": "a983c8c043b1fbf1d95df78a29149222dac2988c",
"status": "unaffected"
},
{
"at": "0bba5887577b1e328da825bd018815fdc519685a",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "9718f2b90ce086ff8614d5782f4ec528495c98dd",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.18.5",
"versionStartIncluding": "1.15.0-rc.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.19.6",
"versionStartIncluding": "1.19.0-rc.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.20.4",
"versionStartIncluding": "1.20.0-rc.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Thomas Cioppettini / Scalpel Software Inc"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jos\u00e9 Valim"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to \u003ccode\u003einspect/1\u003c/code\u003e, \u003ccode\u003eList.to_string/1\u003c/code\u003e, or \u003ccode\u003eList.to_charlist/1\u003c/code\u003e to exhaust a BEAM node\u0027s memory.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eInspect.List\u003c/code\u003e\u0027s charlist branch in \u003ccode\u003elib/elixir/lib/inspect.ex\u003c/code\u003e classifies a list as a charlist using \u003ccode\u003eList.ascii_printable?/2\u003c/code\u003e, which examines only the first \u003ccode\u003e:printable_limit\u003c/code\u003e (4096 by default) elements, and then calls \u003ccode\u003eIO.chardata_to_string/1\u003c/code\u003e on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises \u003ccode\u003eArgumentError\u003c/code\u003e. That conversion runs inside \u003ccode\u003eList.to_string/1\u003c/code\u003e, whose rescue clause builds its message by interpolating \u003ccode\u003einspect(list)\u003c/code\u003e, which re-enters the same branch and raises again. The nested inspection is an argument to \u003ccode\u003eraise\u003c/code\u003e, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by \u003ccode\u003emax_heap_size\u003c/code\u003e or, by default, the node runs out of memory. \u003ccode\u003eList.to_charlist/1\u003c/code\u003e has the same rescue shape.\u003c/p\u003e\n\u003cp\u003eBelow the printable limit the inner \u003ccode\u003einspect/1\u003c/code\u003e sees the invalid element within its counter and renders the list in ordinary bracket form, so a single \u003ccode\u003eArgumentError\u003c/code\u003e is raised and no recursion occurs.\u003c/p\u003e\n\u003cp\u003eThis issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to `inspect/1`, `List.to_string/1`, or `List.to_charlist/1` to exhaust a BEAM node\u0027s memory.\n\n`Inspect.List`\u0027s charlist branch in `lib/elixir/lib/inspect.ex` classifies a list as a charlist using `List.ascii_printable?/2`, which examines only the first `:printable_limit` (4096 by default) elements, and then calls `IO.chardata_to_string/1` on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises `ArgumentError`. That conversion runs inside `List.to_string/1`, whose rescue clause builds its message by interpolating `inspect(list)`, which re-enters the same branch and raises again. The nested inspection is an argument to `raise`, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by `max_heap_size` or, by default, the node runs out of memory. `List.to_charlist/1` has the same rescue shape.\n\nBelow the printable limit the inner `inspect/1` sees the invalid element within its counter and renders the list in ordinary bracket form, so a single `ArgumentError` is raised and no recursion occurs.\n\nThis issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4."
}
],
"value": "Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node\u0027s memory.\n\nInspect.List\u0027s charlist branch in lib/elixir/lib/inspect.ex classifies a list as a charlist using List.ascii_printable?/2, which examines only the first :printable_limit (4096 by default) elements, and then calls IO.chardata_to_string/1 on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises ArgumentError. That conversion runs inside List.to_string/1, whose rescue clause builds its message by interpolating inspect(list), which re-enters the same branch and raises again. The nested inspection is an argument to raise, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by max_heap_size or, by default, the node runs out of memory. List.to_charlist/1 has the same rescue shape.\n\nBelow the printable limit the inner inspect/1 sees the invalid element within its counter and renders the list in ordinary bracket form, so a single ArgumentError is raised and no recursion occurs.\n\nThis issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T11:28:53.505Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-jf5q-v438-665c"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-75758.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-75758"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/1eff1acffd49bdcc0d7f57ca74c1603328eed68a"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/5230d73968f1b4969d2a2646786fa6c71475f5cc"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/a983c8c043b1fbf1d95df78a29149222dac2988c"
},
{
"tags": [
"patch"
],
"url": "https://github.com/elixir-lang/elixir/commit/0bba5887577b1e328da825bd018815fdc519685a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInstall a global inspect function that renders lists as lists rather than inferring charlists, by calling \u003ccode\u003eInspect.Opts.default_inspect_fun/1\u003c/code\u003e with \u003ccode\u003efn term, opts -\u0026gt; Inspect.inspect(term, %{opts | charlists: :as_lists}) end\u003c/code\u003e from the application\u0027s start callback. This keeps the charlist branch from being entered at all, so the mis-inferred conversion never raises and the error path cannot recurse.\u003c/p\u003e\n\u003cp\u003eThe trade-off is global: charlists then render in bracket form, so \u003ccode\u003e~c\"abc\"\u003c/code\u003e inspects as \u003ccode\u003e[97, 98, 99]\u003c/code\u003e everywhere in the application, including in logs and error reports.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Install a global inspect function that renders lists as lists rather than inferring charlists, by calling `Inspect.Opts.default_inspect_fun/1` with `fn term, opts -\u003e Inspect.inspect(term, %{opts | charlists: :as_lists}) end` from the application\u0027s start callback. This keeps the charlist branch from being entered at all, so the mis-inferred conversion never raises and the error path cannot recurse.\n\nThe trade-off is global: charlists then render in bracket form, so `~c\"abc\"` inspects as `[97, 98, 99]` everywhere in the application, including in logs and error reports."
}
],
"value": "Install a global inspect function that renders lists as lists rather than inferring charlists, by calling Inspect.Opts.default_inspect_fun/1 with fn term, opts -\u003e Inspect.inspect(term, %{opts | charlists: :as_lists}) end from the application\u0027s start callback. This keeps the charlist branch from being entered at all, so the mis-inferred conversion never raises and the error path cannot recurse.\n\nThe trade-off is global: charlists then render in bracket form, so ~c\"abc\" inspects as [97, 98, 99] everywhere in the application, including in logs and error reports."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-75758",
"datePublished": "2026-08-28T11:28:53.505Z",
"dateReserved": "2026-08-19T09:00:01.955Z",
"dateUpdated": "2026-08-28T18:29:23.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74795 (GCVE-0-2026-74795)
Vulnerability from cvelistv5 – Published: 2026-08-16 13:14 – Updated: 2026-08-17 16:04
VLAI
EPSS
VEX
Title
Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion
Summary
Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does not enforce a default expression depth limit (the ExpressionDepthLimit property in ParserOptions defaults to null/disabled), so an attacker who controls template input can supply a deeply nested template (e.g., thousands of nested parentheses or blocks) that exhausts thread stack space and raises a StackOverflowException. Because a StackOverflowException cannot be caught in .NET, this causes immediate, unrecoverable termination of the hosting process, resulting in a denial of service. Applications that process untrusted or user-supplied templates can be exploited remotely without authentication.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 15:44 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/scriban/scriban/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/scriban-befo… | third-party-advisory |
Impacted products
Date Public
2026-03-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74795",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T15:44:46.652633Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T16:04:35.166Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:nuget/scriban",
"product": "scriban",
"vendor": "scriban",
"versions": [
{
"lessThan": "6.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-03-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does not enforce a default expression depth limit (the ExpressionDepthLimit property in ParserOptions defaults to null/disabled), so an attacker who controls template input can supply a deeply nested template (e.g., thousands of nested parentheses or blocks) that exhausts thread stack space and raises a StackOverflowException. Because a StackOverflowException cannot be caught in .NET, this causes immediate, unrecoverable termination of the hosting process, resulting in a denial of service. Applications that process untrusted or user-supplied templates can be exploited remotely without authentication."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-16T13:14:17.698Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wgh7-7m3c-fx25)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/scriban/scriban/security/advisories/GHSA-wgh7-7m3c-fx25"
},
{
"name": "VulnCheck Advisory: Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/scriban-before-denial-of-service-via-uncontrolled-recursion"
}
],
"title": "Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-74795",
"datePublished": "2026-08-16T13:14:17.698Z",
"dateReserved": "2026-08-16T12:59:42.222Z",
"dateUpdated": "2026-08-17T16:04:35.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74794 (GCVE-0-2026-74794)
Vulnerability from cvelistv5 – Published: 2026-08-16 13:14 – Updated: 2026-08-17 16:43
VLAI
EPSS
VEX
Title
Scriban before 6.6.0 Denial of Service via Infinite Recursion
Summary
Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 16:40 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/scriban/scriban/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/scriban-befo… | third-party-advisory |
Impacted products
Date Public
2026-03-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74794",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T16:40:22.921845Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T16:43:09.113Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/scriban/scriban/security/advisories/GHSA-grr9-747v-xvcp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:nuget/scriban",
"product": "scriban",
"vendor": "scriban",
"versions": [
{
"lessThan": "6.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-03-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-16T13:14:17.004Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-grr9-747v-xvcp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/scriban/scriban/security/advisories/GHSA-grr9-747v-xvcp"
},
{
"name": "VulnCheck Advisory: Scriban before 6.6.0 Denial of Service via Infinite Recursion",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/scriban-before-denial-of-service-via-infinite-recursion"
}
],
"title": "Scriban before 6.6.0 Denial of Service via Infinite Recursion",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-74794",
"datePublished": "2026-08-16T13:14:17.004Z",
"dateReserved": "2026-08-16T12:59:42.222Z",
"dateUpdated": "2026-08-17T16:43:09.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74792 (GCVE-0-2026-74792)
Vulnerability from cvelistv5 – Published: 2026-08-16 13:14 – Updated: 2026-08-18 14:08
VLAI
EPSS
VEX
Title
Scriban before 7.0.0 Stack Overflow via nested array initializers
Summary
Scriban before 7.0.0 (affected versions <= 6.6.0) contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path (ParseArrayInitializer → ParseExpression → ParseArrayInitializer) that is not covered by the ExpressionDepthLimit counter added in the fix for GHSA-wgh7-7m3c-fx25. An attacker who can supply untrusted input to Template.Parse can trigger an uncatchable StackOverflowException that immediately terminates the process, even with the default ExpressionDepthLimit enabled.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 14:07 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/scriban/scriban/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/scriban-befo… | third-party-advisory |
Impacted products
Date Public
2026-03-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74792",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T14:07:56.692914Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T14:08:24.056Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/scriban/scriban/security/advisories/GHSA-p6q4-fgr8-vx4p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:nuget/Scriban",
"product": "scriban",
"vendor": "scriban",
"versions": [
{
"lessThan": "7.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "pawlos"
}
],
"datePublic": "2026-03-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Scriban before 7.0.0 (affected versions \u003c= 6.6.0) contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path (ParseArrayInitializer \u2192 ParseExpression \u2192 ParseArrayInitializer) that is not covered by the ExpressionDepthLimit counter added in the fix for GHSA-wgh7-7m3c-fx25. An attacker who can supply untrusted input to Template.Parse can trigger an uncatchable StackOverflowException that immediately terminates the process, even with the default ExpressionDepthLimit enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-16T13:14:15.706Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-p6q4-fgr8-vx4p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/scriban/scriban/security/advisories/GHSA-p6q4-fgr8-vx4p"
},
{
"name": "VulnCheck Advisory: Scriban before 7.0.0 Stack Overflow via nested array initializers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/scriban-before-stack-overflow-via-nested-array-initializers"
}
],
"title": "Scriban before 7.0.0 Stack Overflow via nested array initializers",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-74792",
"datePublished": "2026-08-16T13:14:15.706Z",
"dateReserved": "2026-08-16T12:56:02.577Z",
"dateUpdated": "2026-08-18T14:08:24.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74787 (GCVE-0-2026-74787)
Vulnerability from cvelistv5 – Published: 2026-08-16 13:14 – Updated: 2026-08-18 14:07
VLAI
EPSS
VEX
Title
Scriban before 7.0.0 Uncontrolled Recursion via object.to_json
Summary
Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that fatally terminates the hosting .NET process.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 14:06 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/scriban/scriban/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/scriban-befo… | third-party-advisory |
Impacted products
Date Public
2026-03-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74787",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T14:06:31.854599Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T14:07:14.547Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/scriban/scriban/security/advisories/GHSA-xcx6-vp38-8hr5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:nuget/Scriban",
"product": "scriban",
"vendor": "scriban",
"versions": [
{
"lessThan": "7.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "offset"
}
],
"datePublic": "2026-03-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that fatally terminates the hosting .NET process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-16T13:14:12.485Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xcx6-vp38-8hr5)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/scriban/scriban/security/advisories/GHSA-xcx6-vp38-8hr5"
},
{
"name": "VulnCheck Advisory: Scriban before 7.0.0 Uncontrolled Recursion via object.to_json",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/scriban-before-uncontrolled-recursion-via-object-to-json"
}
],
"title": "Scriban before 7.0.0 Uncontrolled Recursion via object.to_json",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-74787",
"datePublished": "2026-08-16T13:14:12.485Z",
"dateReserved": "2026-08-16T12:56:02.577Z",
"dateUpdated": "2026-08-18T14:07:14.547Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
Mitigation
Implementation
Increase the stack size.
CAPEC-230: Serialized Data with Nested Payloads
Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization.
CAPEC-231: Oversized Serialized Data Payloads
An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.