CWE-674

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:59:03.206Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "98567",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/98567"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9597"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libxml2",
          "vendor": "Red Hat",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        }
      ],
      "datePublic": "2016-12-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found in libxml2, making it vulnerable to a Denial of Service attack due to a Stack Overflow. This is a regression CVE for the same issue as CVE-2016-3705."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-07-31T09:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "98567",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/98567"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9597"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-9597",
    "datePublished": "2018-07-30T14:00:00.000Z",
    "dateReserved": "2016-11-23T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:59:03.206Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "matrix-synapse"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.61.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-31052"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-29T21:51:23Z",
    "nvd_published_at": "2022-06-28T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nURL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion.\nThis is sometimes recoverable and leads to an error for the request causing the problem, but in other cases the Synapse process may crash altogether.\n\nIt is possible to exploit this maliciously, either by malicious users on the homeserver, or by remote users sending URLs that a local user\u0027s client may automatically request a URL preview for.\nRemote users are not able to exploit this directly, because [the URL preview endpoint is authenticated](https://spec.matrix.org/v1.2/client-server-api/#get_matrixmediav3preview_url).\n\n### Am I affected?\n\n* deployments with `url_preview_enabled: false` set in configuration are not affected.\n* deployments with `url_preview_enabled: true` set in configuration **are** affected.\n* deployments with no configuration value set for `url_preview_enabled` are not affected, because the default is `false`.\n\n### Patches\n\nAdministrators of homeservers with URL previews enabled are advised to upgrade to v1.61.1 or higher.\n\n### Workarounds\n\n* URL previews can be disabled in the configuration file by setting `url_preview_enabled: false`.\n* Deployments using workers can choose to offload URL previews to one or more dedicated worker(s), ensuring that a process crash does not disrupt other functionality of Synapse.\n\n### For more information\n\nIf you have any questions or comments about this advisory, e-mail us at [security@matrix.org](mailto:security@matrix.org).\n",
  "id": "GHSA-22p3-qrh9-cx32",
  "modified": "2024-09-30T20:29:11Z",
  "published": "2022-06-29T21:51:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/synapse/security/advisories/GHSA-22p3-qrh9-cx32"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31052"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/synapse/commit/fa1308061802ac7b7d20e954ba7372c5ac292333"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/matrix-org/synapse"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2022-224.yaml"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7EARKKJZ2W7WUITFDT4EG4NVATFYJQHF"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGSDQ4YAITCUACAB7SXQZDJIU3IQ4CJD"
    },
    {
      "type": "WEB",
      "url": "https://spec.matrix.org/v1.2/client-server-api/#get_matrixmediav3preview_url"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "URL previews of unusual or maliciously-crafted pages can crash Synapse media repositories or Synapse monoliths"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.5"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:token-macro"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-1003011"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-25T23:16:02Z",
    "nvd_published_at": "2019-02-06T16:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Jenkins Token Macro Plugin recursively applied token expansion.\n\nThis could be used by users able to affect input to token expansion (such as change log messages), to inject additional tokens into the input, which would then be expanded, resulting in information disclosure (for example values of environment variables), or denial of service.\n\nMost tokens have been changed to no longer recursively apply token expansion.",
  "id": "GHSA-23h9-m55m-c5jp",
  "modified": "2023-10-25T23:16:02Z",
  "published": "2022-05-13T01:15:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003011"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/token-macro-plugin/commit/70163600031ea8d43833e6eea928f8fa2e44f96a"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHBA-2019:0326"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHBA-2019:0327"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1102"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jenkins Token Macro Plugin\u0027s recursive token expansion results in information disclosure and DoS"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-12825"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-05-12T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption.",
  "id": "GHSA-23x2-xqxm-pxwj",
  "modified": "2022-08-22T00:00:58Z",
  "published": "2022-05-24T17:17:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12825"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.gnome.org/GNOME/libcroco/-/issues/8"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202208-33"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/08/13/3"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/09/08/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.0"
            },
            {
              "fixed": "2.6.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.7.0"
            },
            {
              "fixed": "2.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.7.0"
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-cpu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-cpu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.0"
            },
            {
              "fixed": "2.6.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-cpu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.7.0"
            },
            {
              "fixed": "2.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.7.0"
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-gpu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-gpu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.0"
            },
            {
              "fixed": "2.6.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-gpu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.7.0"
            },
            {
              "fixed": "2.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.7.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2022-23591"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-02-04T18:23:58Z",
    "nvd_published_at": "2022-02-04T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nThe `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a `GraphDef` containing a fragment such as the following can be consumed when loading a `SavedModel`:\n\n```\n  library {\n    function {\n      signature {\n        name: \"SomeOp\"\n        description: \"Self recursive op\"\n      }\n      node_def {\n        name: \"1\"\n        op: \"SomeOp\"\n      }\n      node_def {\n        name: \"2\"\n        op: \"SomeOp\"\n      }\n    }\n  } \n```\n\nThis would result in a stack overflow during execution as resolving each `NodeDef` means resolving the function itself and its nodes.\n\n### Patches\nWe have patched the issue in GitHub commit [448a16182065bd08a202d9057dd8ca541e67996c](https://github.com/tensorflow/tensorflow/commit/448a16182065bd08a202d9057dd8ca541e67996c).\n\nThe fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.\n\n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.",
  "id": "GHSA-247x-2f9f-5wp7",
  "modified": "2024-11-13T22:14:32Z",
  "published": "2022-02-09T23:30:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-247x-2f9f-5wp7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23591"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tensorflow/tensorflow/commit/448a16182065bd08a202d9057dd8ca541e67996c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-100.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-155.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tensorflow/tensorflow"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Stack overflow in TensorFlow"
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-9438"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-06-05T17:29:00Z",
    "severity": "HIGH"
  },
  "details": "libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex strings) that is mishandled in the _yr_re_emit function, a different vulnerability than CVE-2017-9304.",
  "id": "GHSA-24f8-4r56-7793",
  "modified": "2025-04-20T03:38:30Z",
  "published": "2022-05-13T01:10:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9438"
    },
    {
      "type": "WEB",
      "url": "https://github.com/VirusTotal/yara/issues/674"
    },
    {
      "type": "WEB",
      "url": "https://github.com/VirusTotal/yara/commit/10e8bd3071677dd1fa76beeef4bc2fc427cea5e7"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKNXSH5ERG6NELTXCYVJLUPJJJ2TNEBD"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXM224OLGI6KAOROLDPPGGCZ2OQVQ6HH"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FKNXSH5ERG6NELTXCYVJLUPJJJ2TNEBD"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXM224OLGI6KAOROLDPPGGCZ2OQVQ6HH"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-53288"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-26T20:17:21Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: Reserve an extra page for early kernel mapping\n\nThe final part of [data, end) segment may overflow into the next page of\ninit_pg_end[1] which is the gap page before early_init_stack[2]:\n\n[1]\ncrash_arm64_v9.0.1\u003e vtop ffffffed00601000\nVIRTUAL           PHYSICAL\nffffffed00601000  83401000\n\nPAGE DIRECTORY: ffffffecffd62000\n   PGD: ffffffecffd62da0 =\u003e 10000000833fb003\n   PMD: ffffff80033fb018 =\u003e 10000000833fe003\n   PTE: ffffff80033fe008 =\u003e 68000083401f03\n  PAGE: 83401000\n\n     PTE        PHYSICAL  FLAGS\n68000083401f03  83401000  (VALID|SHARED|AF|NG|PXN|UXN)\n\n      PAGE       PHYSICAL      MAPPING       INDEX CNT FLAGS\nfffffffec00d0040 83401000                0        0  1 4000 reserved\n\n[2]\nffffffed002c8000 (r) __pi__data\nffffffed0054e000 (d) __pi___bss_start\nffffffed005f5000 (b) __pi_init_pg_dir\nffffffed005fe000 (b) __pi_init_pg_end\nffffffed005ff000 (B) early_init_stack\nffffffed00608000 (b) __pi__end\n\nFor 4K pages, the early kernel mapping may use 2MB block entries but the\nkernel segments are only 64KB aligned. Segment boundaries that fall\nwithin a 2MB block therefore require a PTE table so that different\nattributes can be applied on either side of the boundary.\n\nKERNEL_SEGMENT_COUNT still correctly counts the five permanent kernel\nVMAs registered by declare_kernel_vmas(). However, since commit\n5973a62efa34 (\"arm64: map [_text, _stext) virtual address range\nnon-executable+read-only\"), the early mapper also maps [_text, _stext)\nseparately from [_stext, _etext). This adds one more early-only split\nand can require one more page-table page than the existing\nEARLY_SEGMENT_EXTRA_PAGES allowance reserves.\n\nIncrease the 4K-page early mapping allowance by one page to cover that\nadditional split.\n\n[catalin.marinas@arm.com: rewrote part of the commit log]\n[catalin.marinas@arm.com: expanded the code comment]",
  "id": "GHSA-24wq-6x4v-q3fv",
  "modified": "2026-07-08T06:31:35Z",
  "published": "2026-06-26T21:32:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53288"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4d8e74ad4585672489da6145b3328d415f50db82"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9fe9e3acaa14921b0cf0d6cc2de5b562499bf721"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a4ff33053da0a34b14abb5c96dc5a48379e26fce"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dcb89deed40ba55ff7020061712fdabf098cc2cc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "flatted"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32141"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-13T15:40:42Z",
    "nvd_published_at": "2026-03-12T18:16:25Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nflatted\u0027s `parse()` function uses a recursive `revive()` phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential `$` indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process.\n\n## Impact\n\nDenial of Service (DoS). Any application that passes untrusted input to `flatted.parse()` can be crashed by an unauthenticated attacker with a single request.\n\nflatted has ~87M weekly npm downloads and is used as the circular-JSON serialization layer in many caching and logging libraries.\n\n## Proof of Concept\n\n```javascript\nconst flatted = require(\u0027flatted\u0027);\n\n// Build deeply nested circular reference chain\nconst depth = 20000;\nconst arr = new Array(depth + 1);\narr[0] = \u0027{\"a\":\"1\"}\u0027;\nfor (let i = 1; i \u003c= depth; i++) {\n  arr[i] = `{\"a\":\"${i + 1}\"}`;\n}\narr[depth] = \u0027{\"a\":\"leaf\"}\u0027;\n\nconst payload = JSON.stringify(arr);\nflatted.parse(payload); // RangeError: Maximum call stack size exceeded\n```\n\n## Fix\n\nThe maintainer has already merged an iterative (non-recursive) implementation in PR #88, converting the recursive `revive()` to a stack-based loop.\n\n## Affected Versions\n\nAll versions prior to the PR #88 fix.",
  "id": "GHSA-25h7-pfq9-p65f",
  "modified": "2026-03-13T15:40:42Z",
  "published": "2026-03-13T15:40:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32141"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WebReflection/flatted/pull/88"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WebReflection/flatted"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "flatted vulnerable to unbounded recursion DoS in parse() revive phase"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "moodle/moodle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.11.0-beta"
            },
            {
              "fixed": "3.11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "moodle/moodle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.10.0-beta"
            },
            {
              "fixed": "3.10.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "moodle/moodle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-36395"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-07T20:57:09Z",
    "nvd_published_at": "2023-03-06T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "In Moodle, the file repository\u0027s URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.",
  "id": "GHSA-273w-7fxj-pcp6",
  "modified": "2025-03-07T21:32:22Z",
  "published": "2023-03-06T21:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36395"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/moodle/moodle"
    },
    {
      "type": "WEB",
      "url": "https://moodle.org/mod/forum/discuss.php?d=424801"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Moodle vulnerable to Uncontrolled Resource Consumption"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "oras.land/oras"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55588"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-674",
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T18:19:15Z",
    "nvd_published_at": "2026-08-25T21:17:02Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nA malicious OCI registry can return a **cyclic referrer graph** (e.g. `A -\u003e A` or `A -\u003e B -\u003e A`). The ORAS CLI\u0027s recursive referrer traversal does not track visited descriptors, so a cycle causes unbounded recursion and memory growth \u2014 a client-side denial of service.\n\nThis affects `oras discover` (recursive referrer traversal) and the recursive referrer counting used by `oras backup` and `oras restore`. Because `oras discover --depth` defaults to `0` (unlimited), `discover` is affected out of the box.\n\n\u003e **Note:** This advisory covers only the **ORAS CLI** (`oras.land/oras`). The related Referrers API pagination loop in the `oras-go` library is tracked in a separate advisory on the [oras-go](https://github.com/oras-project/oras-go) repository.\n\n### Details\n\nIn `oras discover`, recursive referrer traversal follows discovered referrers without maintaining a visited-descriptor set.\n\nSimplified flow:\n\n```text\nrunDiscover\n  -\u003e fetchAllReferrers(root)\n     -\u003e registry.Referrers(root)\n     -\u003e for each referrer:\n          fetchAllReferrers(referrer)\n```\n\nA malicious registry can create cyclic graphs such as:\n\n```text\nA -\u003e A\n```\n\nor\n\n```text\nA -\u003e B -\u003e A\n```\n\nBecause traversal does not track previously visited descriptors, recursion never reaches a terminating condition.\n\nSimilarly, the recursive counting logic (`graph.RecursiveFindReferrers`, used by the `backup` and `restore` workflows) accumulates descriptors without cycle detection, causing unbounded memory growth.\n\n### PoC\n\nCreate valid descriptors where:\n\n```text\nreferrers(A) = [A]\n```\n\nor:\n\n```text\nreferrers(A) = [B]\nreferrers(B) = [A]\n```\n\nRun:\n\n```bash\noras discover attacker.local/repo@sha256:\u003cA\u003e\n```\n\nThe recursive traversal continues indefinitely, causing unbounded recursion and eventual resource exhaustion.\n\n### Impact\n\nA malicious OCI registry can trigger client-side denial of service against ORAS CLI users and automation.\n\nPotential impacts include:\n\n- Excessive CPU utilization\n- Excessive memory consumption\n- Unbounded recursion\n- Hung CI/CD jobs\n- Stalled automation pipelines\n- Failed backup or discovery operations\n\nThe issue does not enable arbitrary code execution, artifact substitution, or integrity bypass, but it can reliably prevent ORAS operations from completing when interacting with malicious registry metadata.\n\n### Patch\n\n- `cmd/oras/root/discover.go` \u2014 `fetchAllReferrers` threads a `visited` digest set; an already-traversed descriptor returns immediately, breaking cycles. Behavior is unchanged for valid (acyclic) referrer graphs.\n- `internal/graph/graph.go` \u2014 `RecursiveFindReferrers` tracks visited descriptors by digest and only recurses into unseen referrers, so traversal terminates on a cyclic graph.",
  "id": "GHSA-298f-872v-2rcx",
  "modified": "2026-08-28T18:19:15Z",
  "published": "2026-08-28T18:19:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/oras-project/oras/security/advisories/GHSA-298f-872v-2rcx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55588"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oras-project/oras/commit/440eb65d07a0631f131944d28e7c29d562ec17f3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/oras-project/oras"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption"
}