CWE-674
Allowed-with-ReviewUncontrolled Recursion
Abstraction: Class · Status: Draft
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
751 vulnerabilities reference this CWE, most recent first.
GHSA-834W-G79F-WRQV
Vulnerability from github – Published: 2022-05-13 01:08 – Updated: 2022-05-13 01:08An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.
{
"affected": [],
"aliases": [
"CVE-2018-6003"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-22T20:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.",
"id": "GHSA-834w-g79f-wrqv",
"modified": "2022-05-13T01:08:59Z",
"published": "2022-05-13T01:08:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6003"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1535926"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1076832"
},
{
"type": "WEB",
"url": "https://gitlab.com/gnutls/libtasn1/commit/946565d8eb05fbf7970ea366e817581bb5a90910"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4106"
},
{
"type": "WEB",
"url": "http://git.savannah.nongnu.org/cgit/libtasn1.git/commit/?id=c593ae84cfcde8fea45787e53950e0ac71e9ca97"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-86Q4-P3XC-6M2H
Vulnerability from github – Published: 2022-05-24 17:44 – Updated: 2022-05-24 17:44The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
{
"affected": [],
"aliases": [
"CVE-2020-1898"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-11T01:15:00Z",
"severity": "HIGH"
},
"details": "The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.",
"id": "GHSA-86q4-p3xc-6m2h",
"modified": "2022-05-24T17:44:15Z",
"published": "2022-05-24T17:44:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1898"
},
{
"type": "WEB",
"url": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c"
},
{
"type": "WEB",
"url": "https://hhvm.com/blog/2020/06/30/security-update.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-87RM-8Q5W-499G
Vulnerability from github – Published: 2022-05-24 17:43 – Updated: 2022-05-24 17:43An issue was discovered in OSSEC 3.6.0. An uncontrolled recursion vulnerability in os_xml.c occurs when a large number of opening and closing XML tags is used. Because recursion is used in _ReadElem without restriction, an attacker can trigger a segmentation fault once unmapped memory is reached.
{
"affected": [],
"aliases": [
"CVE-2021-28040"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-05T18:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in OSSEC 3.6.0. An uncontrolled recursion vulnerability in os_xml.c occurs when a large number of opening and closing XML tags is used. Because recursion is used in _ReadElem without restriction, an attacker can trigger a segmentation fault once unmapped memory is reached.",
"id": "GHSA-87rm-8q5w-499g",
"modified": "2022-05-24T17:43:48Z",
"published": "2022-05-24T17:43:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28040"
},
{
"type": "WEB",
"url": "https://github.com/ossec/ossec-hids/issues/1953"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-892M-GCQ8-2468
Vulnerability from github – Published: 2026-08-23 15:33 – Updated: 2026-08-25 16:40Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-v7cf-c9rm-wm3j. This link is maintained to preserve external references.
Original Description
justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested tags, roughly 11 KB) to exceed CPython's default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application's exception handling.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "justhtml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.9.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-25T16:40:27Z",
"nvd_published_at": "2026-08-23T14:16:55Z",
"severity": "HIGH"
},
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-v7cf-c9rm-wm3j. This link is maintained to preserve external references.\n\n### Original Description\njusthtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g., ~1000 nested \u003cdiv\u003e tags, roughly 11 KB) to exceed CPython\u0027s default recursion limit and trigger an unhandled RecursionError, which may abort parsing, fail requests, or terminate a worker/process depending on the host application\u0027s exception handling.",
"id": "GHSA-892m-gcq8-2468",
"modified": "2026-08-25T16:40:27Z",
"published": "2026-08-23T15:33:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-v7cf-c9rm-wm3j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9769"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/justhtml-before-denial-of-service-via-deeply-nested-html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "Duplicate Advisory: Uncontrolled recursion DoS in JustHTML() via deeply nested HTML",
"withdrawn": "2026-08-25T16:40:27Z"
}
GHSA-8C28-5MP7-V24H
Vulnerability from github – Published: 2022-12-13 17:02 – Updated: 2022-12-13 17:02Problem
Requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded.
This vulnerability is very similar, but not identical, to the one described in TYPO3-CORE-SA-2021-005 (CVE-2021-21359).
Solution
Update to TYPO3 versions 9.5.38 ELTS, 10.4.33 or 11.5.20 that fix the problem described above.
References
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms-core"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.5.38"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms-core"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.4.33"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms-core"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.5.20"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.4.33"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.5.20"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-23500"
],
"database_specific": {
"cwe_ids": [
"CWE-405",
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-13T17:02:09Z",
"nvd_published_at": "2022-12-14T08:15:00Z",
"severity": "MODERATE"
},
"details": "### Problem\nRequesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded.\n\nThis vulnerability is very similar, but not identical, to the one described in [TYPO3-CORE-SA-2021-005](https://typo3.org/security/advisory/typo3-core-sa-2021-005) (CVE-2021-21359).\n\n### Solution\nUpdate to TYPO3 versions 9.5.38 ELTS, 10.4.33 or 11.5.20 that fix the problem described above.\n\n### References\n* [TYPO3-CORE-SA-2022-012](https://typo3.org/security/advisory/typo3-core-sa-2022-012)",
"id": "GHSA-8c28-5mp7-v24h",
"modified": "2022-12-13T17:02:09Z",
"published": "2022-12-13T17:02:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/TYPO3/typo3/security/advisories/GHSA-8c28-5mp7-v24h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23500"
},
{
"type": "WEB",
"url": "https://github.com/TYPO3/typo3/commit/1e5f44417f031c9c5a9f9d09a6a841cf89aa7b7a"
},
{
"type": "WEB",
"url": "https://github.com/TYPO3/typo3/commit/73b46b6a627093112cfca4b895a198ca5e1970b7"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-23500.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/TYPO3/typo3"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-core-sa-2022-012"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "TYPO3 CMS vulnerable to Denial of Service in Page Error Handling"
}
GHSA-8C3Q-4M86-34F8
Vulnerability from github – Published: 2022-05-24 16:58 – Updated: 2023-02-27 18:32find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.
{
"affected": [],
"aliases": [
"CVE-2019-17450"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-10T17:15:00Z",
"severity": "MODERATE"
},
"details": "find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.",
"id": "GHSA-8c3q-4m86-34f8",
"modified": "2023-02-27T18:32:10Z",
"published": "2022-05-24T16:58:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17450"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202007-39"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20191024-0002"
},
{
"type": "WEB",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=25078"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4336-1"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00078.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00004.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8F6J-9HH3-9C9X
Vulnerability from github – Published: 2022-05-24 17:24 – Updated: 2022-05-24 17:24In imap_scan_tree_recursive in Claws Mail through 3.17.6, a malicious IMAP server can trigger stack consumption because of unlimited recursion into subdirectories during a rebuild of the folder tree.
{
"affected": [],
"aliases": [
"CVE-2020-16094"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-07-28T19:15:00Z",
"severity": "MODERATE"
},
"details": "In imap_scan_tree_recursive in Claws Mail through 3.17.6, a malicious IMAP server can trigger stack consumption because of unlimited recursion into subdirectories during a rebuild of the folder tree.",
"id": "GHSA-8f6j-9hh3-9c9x",
"modified": "2022-05-24T17:24:33Z",
"published": "2022-05-24T17:24:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-16094"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3CRKHUOVTJBHT53J4CYU53PXYYQKSGEA"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JUBLHUG2UCXVABAGN5FVTD3AB3YKE5NN"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YNJIXYDMSXYDII4ERMQ4EEKZX64U3QR4"
},
{
"type": "WEB",
"url": "https://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=4313"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-8F7G-VMW6-89M7
Vulnerability from github – Published: 2022-12-04 06:30 – Updated: 2022-12-06 15:30Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated messages.
{
"affected": [],
"aliases": [
"CVE-2022-46405"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-04T04:15:00Z",
"severity": "HIGH"
},
"details": "Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled recursion of attacker-generated messages.",
"id": "GHSA-8f7g-vmw6-89m7",
"modified": "2022-12-06T15:30:30Z",
"published": "2022-12-04T06:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46405"
},
{
"type": "WEB",
"url": "https://borg.social/notes/98bcoo2t1n"
},
{
"type": "WEB",
"url": "https://hackmd.io/rD9nsTz1QeuPT-erxqjY-A"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8H8C-F86R-PF3C
Vulnerability from github – Published: 2025-02-19 00:31 – Updated: 2025-11-03 21:32A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting.
{
"affected": [],
"aliases": [
"CVE-2024-57257"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-18T23:15:09Z",
"severity": "LOW"
},
"details": "A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting.",
"id": "GHSA-8h8c-f86r-pf3c",
"modified": "2025-11-03T21:32:46Z",
"published": "2025-02-19T00:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57257"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00001.html"
},
{
"type": "WEB",
"url": "https://source.denx.de/u-boot/u-boot/-/commit/4f5cc096bfd0a591f8a11e86999e3d90a9484c34"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2025/02/17/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-8JJ7-4V57-FRF5
Vulnerability from github – Published: 2026-08-24 20:09 – Updated: 2026-08-24 20:09Summary
The move_plugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker.
Details
move_plugin (in cms/admin/placeholderadmin.py) accepts a plugin_parent POST parameter and, for an in-placeholder move, sets the plugin's parent to the target without any cycle/ancestor check. If the target parent is a descendant of the moved plugin, the resulting parent_id graph contains a cycle.
Descendant and ancestor traversal is implemented with WITH RECURSIVE CTEs (_get_descendants_cte / _get_ancestors_cte in cms/models/pluginmodel.py) that have no cycle clause or depth limit. On a cyclic tree these recurse indefinitely (PostgreSQL/SQLite) or error at the recursion limit (MySQL). get_descendants() is invoked while building the move response and on subsequent operations on the affected subtree.
Impact
An authenticated staff user with permission to change plugins in at least one placeholder can corrupt that placeholder's plugin tree, causing requests that traverse it (rendering, copy, delete) to hang and consume application workers (denial of service). The tree is also left in a corrupted state.
Requires CMS_PERMISSION/plugin-change permission on a placeholder.
Patches
Fixed in 5.0.8: move_plugin now rejects (HTTP 400) any move that would place a plugin inside itself or one of its descendants, before any tree mutation or traversal.
Workarounds
None. Upgrade is recommended.
Credits
Reported by the security team at the University of Sydney ([@reporter]).
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "django-cms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54623"
],
"database_specific": {
"cwe_ids": [
"CWE-674",
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-24T20:09:43Z",
"nvd_published_at": "2026-08-20T18:16:28Z",
"severity": "HIGH"
},
"details": "### Summary\nThe `move_plugin` admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker.\n\n### Details\n`move_plugin` (in `cms/admin/placeholderadmin.py`) accepts a `plugin_parent` POST parameter and, for an in-placeholder move, sets the plugin\u0027s parent to the target without any cycle/ancestor check. If the target parent is a descendant of the moved plugin, the resulting `parent_id` graph contains a cycle.\n\nDescendant and ancestor traversal is implemented with `WITH RECURSIVE` CTEs (`_get_descendants_cte` / `_get_ancestors_cte` in `cms/models/pluginmodel.py`) that have no cycle clause or depth limit. On a cyclic tree these recurse indefinitely (PostgreSQL/SQLite) or error at the recursion limit (MySQL). `get_descendants()` is invoked while building the move response and on subsequent operations on the affected subtree.\n\n### Impact\nAn authenticated staff user with permission to change plugins in at least one placeholder can corrupt that placeholder\u0027s plugin tree, causing requests that traverse it (rendering, copy, delete) to hang and consume application workers (denial of service). The tree is also left in a corrupted state.\n\nRequires `CMS_PERMISSION`/plugin-change permission on a placeholder.\n\n### Patches\nFixed in 5.0.8: `move_plugin` now rejects (HTTP 400) any move that would place a plugin inside itself or one of its descendants, before any tree mutation or traversal.\n\n### Workarounds\nNone. Upgrade is recommended.\n\n### Credits\nReported by the security team at the University of Sydney ([@reporter]).",
"id": "GHSA-8jj7-4v57-frf5",
"modified": "2026-08-24T20:09:43Z",
"published": "2026-08-24T20:09:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8jj7-4v57-frf5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54623"
},
{
"type": "WEB",
"url": "https://github.com/django-cms/django-cms/pull/8645"
},
{
"type": "WEB",
"url": "https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c"
},
{
"type": "PACKAGE",
"url": "https://github.com/django-cms/django-cms"
},
{
"type": "WEB",
"url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "django CMS: Plugin move endpoint allows cyclic reparenting (DoS)"
}
Mitigation
Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
Mitigation
Increase the stack size.
CAPEC-230: Serialized Data with Nested Payloads
Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization.
CAPEC-231: Oversized Serialized Data Payloads
An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.