CWE-674

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-78228",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T14:55:44.685926Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T14:56:07.859Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ash-project/ash_oban/security/advisories/GHSA-94p7-498r-mrhp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_oban:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshOban.Transformers.DefineSchedulers\u0027"
          ],
          "packageName": "ash_oban",
          "packageURL": "pkg:hex/ash_oban",
          "product": "ash_oban",
          "programFiles": [
            "lib/transformers/define_schedulers.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshOban.Transformers.DefineSchedulers\u0027:handle_error/4"
            }
          ],
          "repo": "https://github.com/ash-project/ash_oban",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "0.8.14",
              "status": "affected",
              "version": "0.8.0-rc.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_oban:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshOban.Transformers.DefineSchedulers\u0027"
          ],
          "packageName": "ash-project/ash_oban",
          "packageURL": "pkg:github/ash-project/ash_oban",
          "product": "ash_oban",
          "programFiles": [
            "lib/transformers/define_schedulers.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshOban.Transformers.DefineSchedulers\u0027:handle_error/4"
            }
          ],
          "repo": "https://github.com/ash-project/ash_oban",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "851cd0e76ed882bf736fc48d10f96d037e26b5f0",
              "status": "affected",
              "version": "5d117ed2006df7277561c69dbfd39281da6ace9f",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA trigger must declare an \u003ccode\u003eon_error\u003c/code\u003e action and run through the atomic worker branch. An attacker needs only to drive that \u003ccode\u003eon_error\u003c/code\u003e action into a deterministic failure (for example by pushing the record into a state the action rejects) and let the job reach its final attempt.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "A trigger must declare an `on_error` action and run through the atomic worker branch. An attacker needs only to drive that `on_error` action into a deterministic failure (for example by pushing the record into a state the action rejects) and let the job reach its final attempt."
            }
          ],
          "value": "A trigger must declare an on_error action and run through the atomic worker branch. An attacker needs only to drive that on_error action into a deterministic failure (for example by pushing the record into a state the action rejects) and let the job reach its final attempt."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ash-project:ash_oban:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.8.14",
                  "versionStartIncluding": "0.8.0-rc.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel / Ash Project"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger\u0027s \u003ccode\u003eon_error\u003c/code\u003e action to fail on the final attempt to exhaust worker CPU and memory, denying service.\u003c/p\u003e\n\u003cp\u003eThe generated worker\u0027s atomic \u003ccode\u003ehandle_error/4\u003c/code\u003e runs the trigger\u0027s \u003ccode\u003eon_error\u003c/code\u003e action on a job\u0027s final attempt inside a \u003ccode\u003erescue\u003c/code\u003e that, when the action itself raises, calls \u003ccode\u003ehandle_error/4\u003c/code\u003e again with the same job. The job\u0027s \u003ccode\u003eattempt\u003c/code\u003e still equals \u003ccode\u003emax_attempts\u003c/code\u003e, so it re-enters the same clause and re-runs the failing action, with no exit. Any deterministic \u003ccode\u003eon_error\u003c/code\u003e failure (a data-layer outage, a misconfigured action, or a record the action rejects) loops forever; because the recursive call is not in tail position, each iteration retains a formatted stacktrace and the process heap grows without bound while the failing statement is re-issued against the data layer until the runtime kills the worker.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_oban: from 0.8.0-rc.1 before 0.8.14.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger\u0027s `on_error` action to fail on the final attempt to exhaust worker CPU and memory, denying service.\n\nThe generated worker\u0027s atomic `handle_error/4` runs the trigger\u0027s `on_error` action on a job\u0027s final attempt inside a `rescue` that, when the action itself raises, calls `handle_error/4` again with the same job. The job\u0027s `attempt` still equals `max_attempts`, so it re-enters the same clause and re-runs the failing action, with no exit. Any deterministic `on_error` failure (a data-layer outage, a misconfigured action, or a record the action rejects) loops forever; because the recursive call is not in tail position, each iteration retains a formatted stacktrace and the process heap grows without bound while the failing statement is re-issued against the data layer until the runtime kills the worker.\n\nThis issue affects ash_oban: from 0.8.0-rc.1 before 0.8.14."
            }
          ],
          "value": "Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger\u0027s on_error action to fail on the final attempt to exhaust worker CPU and memory, denying service.\n\nThe generated worker\u0027s atomic handle_error/4 runs the trigger\u0027s on_error action on a job\u0027s final attempt inside a rescue that, when the action itself raises, calls handle_error/4 again with the same job. The job\u0027s attempt still equals max_attempts, so it re-enters the same clause and re-runs the failing action, with no exit. Any deterministic on_error failure (a data-layer outage, a misconfigured action, or a record the action rejects) loops forever; because the recursive call is not in tail position, each iteration retains a formatted stacktrace and the process heap grows without bound while the failing statement is re-issued against the data layer until the runtime kills the worker.\n\nThis issue affects ash_oban: from 0.8.0-rc.1 before 0.8.14."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-30T11:51:49.621Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ash-project/ash_oban/security/advisories/GHSA-94p7-498r-mrhp"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-78228.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-78228"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ash-project/ash_oban/commit/851cd0e76ed882bf736fc48d10f96d037e26b5f0"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unbounded handle_error recursion enables denial of service in AshOban triggers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-78228",
    "datePublished": "2026-08-30T11:51:49.621Z",
    "dateReserved": "2026-08-30T00:00:01.991Z",
    "dateUpdated": "2026-08-31T14:56:07.859Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77465",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T13:28:19.437437Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T13:41:25.761Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "toml-node",
          "vendor": "BinaryMuse",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser\u0027s SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T20:37:22.758Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf"
        },
        {
          "name": "https://github.com/BinaryMuse/toml-node/pull/72",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/BinaryMuse/toml-node/pull/72"
        },
        {
          "name": "https://github.com/BinaryMuse/toml-node/commit/967b8b06754f3ecd9863cea118dc50792a8c353f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/BinaryMuse/toml-node/commit/967b8b06754f3ecd9863cea118dc50792a8c353f"
        }
      ],
      "source": {
        "advisory": "GHSA-82x6-q7mm-w9cf",
        "discovery": "UNKNOWN"
      },
      "title": "toml-node: Uncontrolled Recursion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77465",
    "datePublished": "2026-09-03T20:37:22.758Z",
    "dateReserved": "2026-08-20T20:07:49.962Z",
    "dateUpdated": "2026-09-04T13:41:25.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76098",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-24T20:16:30.617465Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-24T20:17:07.057Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mistune",
          "vendor": "lepture",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.3.0, \u003c 3.3.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.render_token() can exceed Python\u0027s recursion limit and raise RecursionError, allowing crafted Markdown to crash a parsing process. This issue is fixed in version 3.3.3"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-24T20:05:00.932Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/lepture/mistune/security/advisories/GHSA-6m44-fpc8-c3rq"
        },
        {
          "name": "https://github.com/lepture/mistune/commit/0938fb7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lepture/mistune/commit/0938fb7"
        }
      ],
      "source": {
        "advisory": "GHSA-6m44-fpc8-c3rq",
        "discovery": "UNKNOWN"
      },
      "title": "Mistune has Denial of Service \u2014 RecursionError via Excessive Emphasis Markers in Markdown"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76098",
    "datePublished": "2026-08-24T20:05:00.932Z",
    "dateReserved": "2026-08-18T21:17:32.201Z",
    "dateUpdated": "2026-08-24T20:17:07.057Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75758",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T18:28:19.564474Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T18:29:23.745Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-jf5q-v438-665c"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Inspect.List\u0027",
            "\u0027Elixir.List\u0027",
            "\u0027Elixir.IO\u0027"
          ],
          "packageName": "elixir",
          "packageURL": "pkg:otp/elixir?repository_url=https:%2F%2Fgithub.com%2Felixir-lang%2Felixir\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Felixir-lang%2Felixir.git",
          "product": "elixir",
          "programFiles": [
            "lib/inspect.ex",
            "lib/list.ex",
            "lib/io.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Inspect.List\u0027:inspect/2"
            },
            {
              "name": "\u0027Elixir.List\u0027:to_string/1"
            },
            {
              "name": "\u0027Elixir.List\u0027:to_charlist/1"
            },
            {
              "name": "\u0027Elixir.List\u0027:ascii_printable?/2"
            },
            {
              "name": "\u0027Elixir.IO\u0027:chardata_to_string/1"
            }
          ],
          "repo": "https://github.com/elixir-lang/elixir",
          "vendor": "elixir-lang",
          "versions": [
            {
              "lessThan": "1.18.5",
              "status": "affected",
              "version": "1.15.0-rc.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.19.6",
              "status": "affected",
              "version": "1.19.0-rc.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.20.4",
              "status": "affected",
              "version": "1.20.0-rc.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Inspect.List\u0027",
            "\u0027Elixir.List\u0027",
            "\u0027Elixir.IO\u0027"
          ],
          "packageName": "elixir-lang/elixir",
          "packageURL": "pkg:github/elixir-lang/elixir",
          "product": "elixir",
          "programFiles": [
            "lib/elixir/lib/inspect.ex",
            "lib/elixir/lib/list.ex",
            "lib/elixir/lib/io.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Inspect.List\u0027:inspect/2"
            },
            {
              "name": "\u0027Elixir.List\u0027:to_string/1"
            },
            {
              "name": "\u0027Elixir.List\u0027:to_charlist/1"
            },
            {
              "name": "\u0027Elixir.List\u0027:ascii_printable?/2"
            },
            {
              "name": "\u0027Elixir.IO\u0027:chardata_to_string/1"
            }
          ],
          "repo": "https://github.com/elixir-lang/elixir",
          "vendor": "elixir-lang",
          "versions": [
            {
              "changes": [
                {
                  "at": "1eff1acffd49bdcc0d7f57ca74c1603328eed68a",
                  "status": "unaffected"
                },
                {
                  "at": "5230d73968f1b4969d2a2646786fa6c71475f5cc",
                  "status": "unaffected"
                },
                {
                  "at": "a983c8c043b1fbf1d95df78a29149222dac2988c",
                  "status": "unaffected"
                },
                {
                  "at": "0bba5887577b1e328da825bd018815fdc519685a",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "9718f2b90ce086ff8614d5782f4ec528495c98dd",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.18.5",
                  "versionStartIncluding": "1.15.0-rc.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.6",
                  "versionStartIncluding": "1.19.0-rc.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:elixir-lang:elixir:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.20.4",
                  "versionStartIncluding": "1.20.0-rc.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Thomas Cioppettini / Scalpel Software Inc"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jos\u00e9 Valim"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to \u003ccode\u003einspect/1\u003c/code\u003e, \u003ccode\u003eList.to_string/1\u003c/code\u003e, or \u003ccode\u003eList.to_charlist/1\u003c/code\u003e to exhaust a BEAM node\u0027s memory.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eInspect.List\u003c/code\u003e\u0027s charlist branch in \u003ccode\u003elib/elixir/lib/inspect.ex\u003c/code\u003e classifies a list as a charlist using \u003ccode\u003eList.ascii_printable?/2\u003c/code\u003e, which examines only the first \u003ccode\u003e:printable_limit\u003c/code\u003e (4096 by default) elements, and then calls \u003ccode\u003eIO.chardata_to_string/1\u003c/code\u003e on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises \u003ccode\u003eArgumentError\u003c/code\u003e. That conversion runs inside \u003ccode\u003eList.to_string/1\u003c/code\u003e, whose rescue clause builds its message by interpolating \u003ccode\u003einspect(list)\u003c/code\u003e, which re-enters the same branch and raises again. The nested inspection is an argument to \u003ccode\u003eraise\u003c/code\u003e, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by \u003ccode\u003emax_heap_size\u003c/code\u003e or, by default, the node runs out of memory. \u003ccode\u003eList.to_charlist/1\u003c/code\u003e has the same rescue shape.\u003c/p\u003e\n\u003cp\u003eBelow the printable limit the inner \u003ccode\u003einspect/1\u003c/code\u003e sees the invalid element within its counter and renders the list in ordinary bracket form, so a single \u003ccode\u003eArgumentError\u003c/code\u003e is raised and no recursion occurs.\u003c/p\u003e\n\u003cp\u003eThis issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to `inspect/1`, `List.to_string/1`, or `List.to_charlist/1` to exhaust a BEAM node\u0027s memory.\n\n`Inspect.List`\u0027s charlist branch in `lib/elixir/lib/inspect.ex` classifies a list as a charlist using `List.ascii_printable?/2`, which examines only the first `:printable_limit` (4096 by default) elements, and then calls `IO.chardata_to_string/1` on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises `ArgumentError`. That conversion runs inside `List.to_string/1`, whose rescue clause builds its message by interpolating `inspect(list)`, which re-enters the same branch and raises again. The nested inspection is an argument to `raise`, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by `max_heap_size` or, by default, the node runs out of memory. `List.to_charlist/1` has the same rescue shape.\n\nBelow the printable limit the inner `inspect/1` sees the invalid element within its counter and renders the list in ordinary bracket form, so a single `ArgumentError` is raised and no recursion occurs.\n\nThis issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4."
            }
          ],
          "value": "Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node\u0027s memory.\n\nInspect.List\u0027s charlist branch in lib/elixir/lib/inspect.ex classifies a list as a charlist using List.ascii_printable?/2, which examines only the first :printable_limit (4096 by default) elements, and then calls IO.chardata_to_string/1 on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises ArgumentError. That conversion runs inside List.to_string/1, whose rescue clause builds its message by interpolating inspect(list), which re-enters the same branch and raises again. The nested inspection is an argument to raise, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by max_heap_size or, by default, the node runs out of memory. List.to_charlist/1 has the same rescue shape.\n\nBelow the printable limit the inner inspect/1 sees the invalid element within its counter and renders the list in ordinary bracket form, so a single ArgumentError is raised and no recursion occurs.\n\nThis issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T11:28:53.505Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/elixir-lang/elixir/security/advisories/GHSA-jf5q-v438-665c"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-75758.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-75758"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-lang/elixir/commit/1eff1acffd49bdcc0d7f57ca74c1603328eed68a"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-lang/elixir/commit/5230d73968f1b4969d2a2646786fa6c71475f5cc"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-lang/elixir/commit/a983c8c043b1fbf1d95df78a29149222dac2988c"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-lang/elixir/commit/0bba5887577b1e328da825bd018815fdc519685a"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInstall a global inspect function that renders lists as lists rather than inferring charlists, by calling \u003ccode\u003eInspect.Opts.default_inspect_fun/1\u003c/code\u003e with \u003ccode\u003efn term, opts -\u0026gt; Inspect.inspect(term, %{opts | charlists: :as_lists}) end\u003c/code\u003e from the application\u0027s start callback. This keeps the charlist branch from being entered at all, so the mis-inferred conversion never raises and the error path cannot recurse.\u003c/p\u003e\n\u003cp\u003eThe trade-off is global: charlists then render in bracket form, so \u003ccode\u003e~c\"abc\"\u003c/code\u003e inspects as \u003ccode\u003e[97, 98, 99]\u003c/code\u003e everywhere in the application, including in logs and error reports.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Install a global inspect function that renders lists as lists rather than inferring charlists, by calling `Inspect.Opts.default_inspect_fun/1` with `fn term, opts -\u003e Inspect.inspect(term, %{opts | charlists: :as_lists}) end` from the application\u0027s start callback. This keeps the charlist branch from being entered at all, so the mis-inferred conversion never raises and the error path cannot recurse.\n\nThe trade-off is global: charlists then render in bracket form, so `~c\"abc\"` inspects as `[97, 98, 99]` everywhere in the application, including in logs and error reports."
            }
          ],
          "value": "Install a global inspect function that renders lists as lists rather than inferring charlists, by calling Inspect.Opts.default_inspect_fun/1 with fn term, opts -\u003e Inspect.inspect(term, %{opts | charlists: :as_lists}) end from the application\u0027s start callback. This keeps the charlist branch from being entered at all, so the mis-inferred conversion never raises and the error path cannot recurse.\n\nThe trade-off is global: charlists then render in bracket form, so ~c\"abc\" inspects as [97, 98, 99] everywhere in the application, including in logs and error reports."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-75758",
    "datePublished": "2026-08-28T11:28:53.505Z",
    "dateReserved": "2026-08-19T09:00:01.955Z",
    "dateUpdated": "2026-08-28T18:29:23.745Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75655",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T03:56:13.304Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Adobe Bridge",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "16.0.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.0.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Adobe Bridge",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "15.1.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.1.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-09-22T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Bridge is affected by an Uncontrolled Recursion vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "HIGH",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "HIGH",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "HIGH",
            "modifiedPrivilegesRequired": "NONE",
            "modifiedScope": "UNCHANGED",
            "modifiedUserInteraction": "REQUIRED",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion (CWE-674)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T18:52:18.930Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/bridge/apsb26-148.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Bridge | Uncontrolled Recursion (CWE-674)",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2026-75655",
    "datePublished": "2026-09-22T18:52:18.930Z",
    "dateReserved": "2026-08-18T01:29:54.615Z",
    "dateUpdated": "2026-09-23T03:56:13.304Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74795",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T15:44:46.652633Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T16:04:35.166Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:nuget/scriban",
          "product": "scriban",
          "vendor": "scriban",
          "versions": [
            {
              "lessThan": "6.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-03-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does not enforce a default expression depth limit (the ExpressionDepthLimit property in ParserOptions defaults to null/disabled), so an attacker who controls template input can supply a deeply nested template (e.g., thousands of nested parentheses or blocks) that exhausts thread stack space and raises a StackOverflowException. Because a StackOverflowException cannot be caught in .NET, this causes immediate, unrecoverable termination of the hosting process, resulting in a denial of service. Applications that process untrusted or user-supplied templates can be exploited remotely without authentication."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-16T13:14:17.698Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-wgh7-7m3c-fx25)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/scriban/scriban/security/advisories/GHSA-wgh7-7m3c-fx25"
        },
        {
          "name": "VulnCheck Advisory: Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/scriban-before-denial-of-service-via-uncontrolled-recursion"
        }
      ],
      "title": "Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-74795",
    "datePublished": "2026-08-16T13:14:17.698Z",
    "dateReserved": "2026-08-16T12:59:42.222Z",
    "dateUpdated": "2026-08-17T16:04:35.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74794",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T16:40:22.921845Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T16:43:09.113Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/scriban/scriban/security/advisories/GHSA-grr9-747v-xvcp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:nuget/scriban",
          "product": "scriban",
          "vendor": "scriban",
          "versions": [
            {
              "lessThan": "6.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-03-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-16T13:14:17.004Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-grr9-747v-xvcp)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/scriban/scriban/security/advisories/GHSA-grr9-747v-xvcp"
        },
        {
          "name": "VulnCheck Advisory: Scriban before 6.6.0 Denial of Service via Infinite Recursion",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/scriban-before-denial-of-service-via-infinite-recursion"
        }
      ],
      "title": "Scriban before 6.6.0 Denial of Service via Infinite Recursion",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-74794",
    "datePublished": "2026-08-16T13:14:17.004Z",
    "dateReserved": "2026-08-16T12:59:42.222Z",
    "dateUpdated": "2026-08-17T16:43:09.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74792",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T14:07:56.692914Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T14:08:24.056Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/scriban/scriban/security/advisories/GHSA-p6q4-fgr8-vx4p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:nuget/Scriban",
          "product": "scriban",
          "vendor": "scriban",
          "versions": [
            {
              "lessThan": "7.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "pawlos"
        }
      ],
      "datePublic": "2026-03-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Scriban before 7.0.0 (affected versions \u003c= 6.6.0) contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path (ParseArrayInitializer \u2192 ParseExpression \u2192 ParseArrayInitializer) that is not covered by the ExpressionDepthLimit counter added in the fix for GHSA-wgh7-7m3c-fx25. An attacker who can supply untrusted input to Template.Parse can trigger an uncatchable StackOverflowException that immediately terminates the process, even with the default ExpressionDepthLimit enabled."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-16T13:14:15.706Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-p6q4-fgr8-vx4p)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/scriban/scriban/security/advisories/GHSA-p6q4-fgr8-vx4p"
        },
        {
          "name": "VulnCheck Advisory: Scriban before 7.0.0 Stack Overflow via nested array initializers",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/scriban-before-stack-overflow-via-nested-array-initializers"
        }
      ],
      "title": "Scriban before 7.0.0 Stack Overflow via nested array initializers",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-74792",
    "datePublished": "2026-08-16T13:14:15.706Z",
    "dateReserved": "2026-08-16T12:56:02.577Z",
    "dateUpdated": "2026-08-18T14:08:24.056Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74787",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T14:06:31.854599Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T14:07:14.547Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/scriban/scriban/security/advisories/GHSA-xcx6-vp38-8hr5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:nuget/Scriban",
          "product": "scriban",
          "vendor": "scriban",
          "versions": [
            {
              "lessThan": "7.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "offset"
        }
      ],
      "datePublic": "2026-03-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that fatally terminates the hosting .NET process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-16T13:14:12.485Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-xcx6-vp38-8hr5)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/scriban/scriban/security/advisories/GHSA-xcx6-vp38-8hr5"
        },
        {
          "name": "VulnCheck Advisory: Scriban before 7.0.0 Uncontrolled Recursion via object.to_json",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/scriban-before-uncontrolled-recursion-via-object-to-json"
        }
      ],
      "title": "Scriban before 7.0.0 Uncontrolled Recursion via object.to_json",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-74787",
    "datePublished": "2026-08-16T13:14:12.485Z",
    "dateReserved": "2026-08-16T12:56:02.577Z",
    "dateUpdated": "2026-08-18T14:07:14.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74783",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T16:48:37.450838Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T16:51:03.164Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/scriban/scriban/security/advisories/GHSA-6q7j-xr26-3h2c"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:nuget/Scriban",
          "product": "scriban",
          "vendor": "scriban",
          "versions": [
            {
              "lessThanOrEqual": "7.2.0",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "MindflareX"
        }
      ],
      "datePublic": "2026-05-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T17:20:28.712Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-6q7j-xr26-3h2c)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/scriban/scriban/security/advisories/GHSA-6q7j-xr26-3h2c"
        },
        {
          "name": "VulnCheck Advisory: Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/scriban-through-parser-recursion-denial-of-service"
        }
      ],
      "title": "Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-74783",
    "datePublished": "2026-08-16T13:14:09.444Z",
    "dateReserved": "2026-08-16T12:56:02.576Z",
    "dateUpdated": "2026-09-30T17:20:28.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}