Common Weakness Enumeration

CWE-674

Allowed-with-Review

Uncontrolled Recursion

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

911 vulnerabilities reference this CWE, most recent first.

GHSA-M7RC-8W7M-R9QR

Vulnerability from github – Published: 2025-04-10 21:07 – Updated: 2025-04-10 21:08
VLAI
Summary
SurrealDB vulnerable to memory exhaustion via nested functions and scripts
Details

In order to prevent DoS situations due to infinite recursions, SurrealDB implements a limit of nested calls for both native functions and embedded JavaScript functions.

However, in SurrealDB instances with embedded scripting functions enabled, it was found that this limit can be circumvented by utilizing both at the same time. If a native function contains JavaScript which issues a new query that calls that function, the recursion limit is not triggered.

Once executed, SurrealDB will follow the path of infinite recursions until the system runs out of memory, prior to the recursion limit being triggered.

This vulnerability can only affect SurrealDB servers explicitly enabling the scripting capability with --allow-scripting or --allow-all and equivalent environment variables SURREAL_CAPS_ALLOW_SCRIPT=true and SURREAL_CAPS_ALLOW_ALL=true.

This issue was discovered and patched during an code audit and penetration test of SurrealDB by cure53, the severity defined within cure53's preliminary finding is Medium, matched by our CVSS v4 assessment.

Impact

For SurrealDB instances with embedded scripting functions enabled, this attack could be used to perform a DoS attack on the server by an authenticated user.

Patches

A patch has been created that further limits scripting function call limit recursion depth and disallows multiple calls to surreadb.query() to run in parallel in a scripting function.

  • Versions 2.0.5, 2.1.5, 2.2.2 and later are not affected by this issue.

Workarounds

Deny execution of embedded scripting functions through the configuration of capabilities by starting SurrealDB with the --deny-scripting flag or the equivalent environment variable SURREAL_CAPS_DENY_SCRIPT=true. This has a usability implication, although scripting functions are disabled by default.

References

SurrealDB Documentation - Capabilities SurrealQL Documentation - Scripting Functions

Severity
6.0 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "surrealdb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "surrealdb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.0"
            },
            {
              "fixed": "2.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "surrealdb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-10T21:07:44Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "In order to prevent DoS situations due to infinite recursions, SurrealDB implements a limit of nested calls for both native functions and embedded JavaScript functions.\n\nHowever, in SurrealDB instances with embedded scripting functions enabled, it was found that this limit can be circumvented by utilizing both at the same time. If a native function contains JavaScript which issues a new query that calls that function, the recursion limit is not triggered.\n\nOnce executed, SurrealDB will follow the path of infinite recursions until the system runs out of memory, prior to the recursion limit being triggered.\n\nThis vulnerability can only affect SurrealDB servers explicitly enabling the scripting capability with `--allow-scripting` or \n`--allow-all` and equivalent environment variables `SURREAL_CAPS_ALLOW_SCRIPT=true` and `SURREAL_CAPS_ALLOW_ALL=true`.\n\nThis issue was discovered and patched during an code audit and penetration test of SurrealDB by cure53, the severity defined within cure53\u0027s preliminary finding is Medium, matched by our CVSS v4 assessment.\n\n### Impact\nFor SurrealDB instances with embedded scripting functions enabled, this attack could be used to perform a DoS attack on the server by an authenticated user. \n\n### Patches\nA patch has been created that further limits scripting function call limit recursion depth and disallows multiple calls to `surreadb.query()` to run in parallel in a scripting function.\n\n- Versions 2.0.5, 2.1.5, 2.2.2 and later are not affected by this issue.\n\n### Workarounds\nDeny execution of embedded scripting functions through the configuration of [capabilities](https://surrealdb.com/docs/surrealdb/security/capabilities#capabilities) by starting SurrealDB with the `--deny-scripting` flag or the equivalent environment variable `SURREAL_CAPS_DENY_SCRIPT=true`. This has a usability implication, although scripting functions are disabled by default.\n\n### References\n[SurrealDB Documentation - Capabilities](https://surrealdb.com/docs/surrealdb/security/capabilities)\n[SurrealQL Documentation - Scripting Functions](https://surrealdb.com/docs/surrealql/functions/script)",
  "id": "GHSA-m7rc-8w7m-r9qr",
  "modified": "2025-04-10T21:08:00Z",
  "published": "2025-04-10T21:07:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m7rc-8w7m-r9qr"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/surrealdb/surrealdb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "SurrealDB vulnerable to memory exhaustion via nested functions and scripts"
}

GHSA-M7W9-72W4-PJR5

Vulnerability from github – Published: 2025-01-08 06:30 – Updated: 2025-01-08 06:30
VLAI
Details

cpdf through 2.8 allows stack consumption via a crafted PDF document.

Severity
4.0 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-54731"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-08T05:15:11Z",
    "severity": "MODERATE"
  },
  "details": "cpdf through 2.8 allows stack consumption via a crafted PDF document.",
  "id": "GHSA-m7w9-72w4-pjr5",
  "modified": "2025-01-08T06:30:55Z",
  "published": "2025-01-08T06:30:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54731"
    },
    {
      "type": "WEB",
      "url": "https://github.com/johnwhitington/cpdf-source/issues/366"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-M8VH-JMQ9-5RJG

Vulnerability from github – Published: 2026-09-29 23:54 – Updated: 2026-09-29 23:54
VLAI
Summary
Nest: Remote process termination via a deeply nested microservice message pattern
Details
Field Value
Ecosystem npm
Package @nestjs/microservices
Affected versions >= 12.0.0, < 12.0.2 and < 11.2.4
Patched versions 12.0.2 and 11.2.4 (upgrade to 12.0.3 / 11.2.5)

Summary

A single message whose pattern is a deeply nested object terminates a NestJS microservice that uses the TCP or RabbitMQ transport. The server serialized the client-supplied pattern with JSON.stringify to derive the handler lookup key; on deeply nested input this throws RangeError: Maximum call stack size exceeded. The exception escaped the asynchronous message handler as an unhandled promise rejection, which terminates the Node.js process under the default --unhandled-rejections=throw.

Impact

Denial of service, one message per crash, repeatable. The attacker needs to be able to reach the transport: connect to the TCP transport's port, or publish to the queue or exchange the service consumes from. The TCP transport performs no authentication by default, so on a reachable port this requires nothing else.

Only the TCP and RabbitMQ transports are affected. The other transports take the pattern as a string from the broker topic or channel and never serialize a client-supplied object to build it.

Details

In ServerTCP#handleMessage and ServerRMQ#handleMessage the pattern was stringified without a guard:

const pattern = isString(packet.pattern)
  ? packet.pattern
  : JSON.stringify(packet.pattern);

JSON.parse accepts nesting depths that JSON.stringify cannot re-serialize, because JSON.stringify recurses natively, so an attacker can craft a payload that parses successfully on arrival and then throws when the pattern is converted back to a string. Neither transport attached a rejection handler to the promise returned by handleMessage, so the RangeError propagated out as an unhandled rejection.

Proof of concept

Against a NestJS microservice on the TCP transport (default port 3001). The nested JSON is built as text rather than with JSON.stringify, which is what makes the payload serializable by the attacker but not by the victim:

const { connect } = require('node:net');

const DEPTH = 100_000;
const pattern = '{"nested":'.repeat(DEPTH) + '{}' + '}'.repeat(DEPTH);
const payload = `{"pattern":${pattern},"data":null,"id":"1"}`;

const socket = connect(3001, '127.0.0.1', () => {
  // Nest's TCP framing is <byteLength>#<json>
  socket.write(`${Buffer.byteLength(payload)}#${payload}`);
});

The service exits with RangeError: Maximum call stack size exceeded. The equivalent payload published to the consumed queue crashes a RabbitMQ-transport service.

Patches

Fixed in 12.0.2 and 11.2.4.

  • Incoming patterns are converted through a guarded Server#getPatternAsString, which falls back to a sentinel value that matches no handler. Such a message now receives the ordinary "no message handler" response (TCP) or is negatively acknowledged (RabbitMQ) instead of crashing the process.
  • Rejections escaping handleMessage in both transports are routed to handleError rather than left unhandled.

Workarounds

If you cannot upgrade, restrict network access to the transport so that only trusted peers can reach it. Running the process with --unhandled-rejections=warn prevents the crash but leaves the message unprocessed and is not a substitute for the fix.

Credit

Reported by ZeroVuln Labs.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@nestjs/microservices"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "11.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@nestjs/microservices"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0"
            },
            {
              "fixed": "12.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-102281"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248",
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-29T23:54:44Z",
    "nvd_published_at": "2026-09-28T22:17:32Z",
    "severity": "HIGH"
  },
  "details": "| Field | Value |\n| --- | --- |\n| Ecosystem | npm |\n| Package | `@nestjs/microservices` |\n| Affected versions | `\u003e= 12.0.0, \u003c 12.0.2` and `\u003c 11.2.4` |\n| Patched versions | `12.0.2` and `11.2.4` (upgrade to `12.0.3` / `11.2.5`) |\n\n### Summary\n\nA single message whose `pattern` is a deeply nested object terminates a NestJS microservice that uses the TCP or\nRabbitMQ transport. The server serialized the client-supplied pattern with `JSON.stringify` to derive the handler\nlookup key; on deeply nested input this throws `RangeError: Maximum call stack size exceeded`. The exception escaped\nthe asynchronous message handler as an unhandled promise rejection, which terminates the Node.js process under the\ndefault `--unhandled-rejections=throw`.\n\n### Impact\n\nDenial of service, one message per crash, repeatable. The attacker needs to be able to reach the transport: connect\nto the TCP transport\u0027s port, or publish to the queue or exchange the service consumes from. The TCP transport\nperforms no authentication by default, so on a reachable port this requires nothing else.\n\nOnly the **TCP** and **RabbitMQ** transports are affected. The other transports take the pattern as a string from the\nbroker topic or channel and never serialize a client-supplied object to build it.\n\n### Details\n\nIn `ServerTCP#handleMessage` and `ServerRMQ#handleMessage` the pattern was stringified without a guard:\n\n```ts\nconst pattern = isString(packet.pattern)\n  ? packet.pattern\n  : JSON.stringify(packet.pattern);\n```\n\n`JSON.parse` accepts nesting depths that `JSON.stringify` cannot re-serialize, because `JSON.stringify` recurses\nnatively, so an attacker can craft a payload that parses successfully on arrival and then throws when the pattern is\nconverted back to a string. Neither transport attached a rejection handler to the promise returned by\n`handleMessage`, so the `RangeError` propagated out as an unhandled rejection.\n\n### Proof of concept\n\nAgainst a NestJS microservice on the TCP transport (default port 3001). The nested JSON is built as text rather than\nwith `JSON.stringify`, which is what makes the payload serializable by the attacker but not by the victim:\n\n```js\nconst { connect } = require(\u0027node:net\u0027);\n\nconst DEPTH = 100_000;\nconst pattern = \u0027{\"nested\":\u0027.repeat(DEPTH) + \u0027{}\u0027 + \u0027}\u0027.repeat(DEPTH);\nconst payload = `{\"pattern\":${pattern},\"data\":null,\"id\":\"1\"}`;\n\nconst socket = connect(3001, \u0027127.0.0.1\u0027, () =\u003e {\n  // Nest\u0027s TCP framing is \u003cbyteLength\u003e#\u003cjson\u003e\n  socket.write(`${Buffer.byteLength(payload)}#${payload}`);\n});\n```\n\nThe service exits with `RangeError: Maximum call stack size exceeded`. The equivalent payload published to the\nconsumed queue crashes a RabbitMQ-transport service.\n\n### Patches\n\nFixed in **12.0.2** and **11.2.4**.\n\n- Incoming patterns are converted through a guarded `Server#getPatternAsString`, which falls back to a sentinel value\n  that matches no handler. Such a message now receives the ordinary \"no message handler\" response (TCP) or is\n  negatively acknowledged (RabbitMQ) instead of crashing the process.\n- Rejections escaping `handleMessage` in both transports are routed to `handleError` rather than left unhandled.\n\n### Workarounds\n\nIf you cannot upgrade, restrict network access to the transport so that only trusted peers can reach it. Running the\nprocess with `--unhandled-rejections=warn` prevents the crash but leaves the message unprocessed and is not a\nsubstitute for the fix.\n\n### Credit\n\nReported by ZeroVuln Labs.",
  "id": "GHSA-m8vh-jmq9-5rjg",
  "modified": "2026-09-29T23:54:44Z",
  "published": "2026-09-29T23:54:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102281"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nestjs/nest/pull/17737"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nestjs/nest/commit/aa97b5144d8dff1ce700aac521eb86449a679d6f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nestjs/nest/commit/e9dcd4c7ac64361fbfe79461da85f5b3fc3e02da"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nestjs/nest"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nestjs/nest/releases/tag/v11.2.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nestjs/nest/releases/tag/v12.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nest: Remote process termination via a deeply nested microservice message pattern"
}

GHSA-MC4Q-93X5-F6HJ

Vulnerability from github – Published: 2026-10-13 20:01 – Updated: 2026-10-19 19:17
VLAI
Summary
Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability
Details

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml and System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

Signed XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/447

CVSS Details

  • Version: 3.1
  • Severity: High
  • Score: 7.5

  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

  • Weakness: CWE-674 (Uncontrolled Recursion)

Affected Platforms

  • Platforms: Windows, Linux, macOS
  • Architectures: All

Affected Packages

The vulnerability affects Microsoft .NET projects that use an affected package version listed below.

Package name Affected version Patched version
Microsoft.NETCore.App.Runtime.linux-arm >= 9.0.0, <= 9.0.20 9.0.21
Microsoft.NETCore.App.Runtime.linux-arm64 >= 9.0.0, <= 9.0.20 9.0.21
Microsoft.NETCore.App.Runtime.linux-musl-arm >= 9.0.0, <= 9.0.20 9.0.21
Microsoft.NETCore.App.Runtime.linux-musl-arm64 >= 9.0.0, <= 9.0.20 9.0.21
Microsoft.NETCore.App.Runtime.linux-musl-x64 >= 9.0.0, <= 9.0.20 9.0.21
Microsoft.NETCore.App.Runtime.linux-x64 >= 9.0.0, <= 9.0.20 9.0.21
Microsoft.NETCore.App.Runtime.osx-arm64 >= 9.0.0, <= 9.0.20 9.0.21
Microsoft.NETCore.App.Runtime.osx-x64 >= 9.0.0, <= 9.0.20 9.0.21
Microsoft.NETCore.App.Runtime.win-arm >= 9.0.0, <= 9.0.20 9.0.21
Microsoft.NETCore.App.Runtime.win-arm64 >= 9.0.0, <= 9.0.20 9.0.21
Microsoft.NETCore.App.Runtime.win-x64 >= 9.0.0, <= 9.0.20 9.0.21
Microsoft.NETCore.App.Runtime.win-x86 >= 9.0.0, <= 9.0.20 9.0.21
Microsoft.NETCore.App.Runtime.linux-arm >= 8.0.0, <= 8.0.31 8.0.32
Microsoft.NETCore.App.Runtime.linux-arm64 >= 8.0.0, <= 8.0.31 8.0.32
Microsoft.NETCore.App.Runtime.linux-musl-arm >= 8.0.0, <= 8.0.31 8.0.32
Microsoft.NETCore.App.Runtime.linux-musl-arm64 >= 8.0.0, <= 8.0.31 8.0.32
Microsoft.NETCore.App.Runtime.linux-musl-x64 >= 8.0.0, <= 8.0.31 8.0.32
Microsoft.NETCore.App.Runtime.linux-x64 >= 8.0.0, <= 8.0.31 8.0.32
Microsoft.NETCore.App.Runtime.osx-arm64 >= 8.0.0, <= 8.0.31 8.0.32
Microsoft.NETCore.App.Runtime.osx-x64 >= 8.0.0, <= 8.0.31 8.0.32
Microsoft.NETCore.App.Runtime.win-arm >= 8.0.0, <= 8.0.31 8.0.32
Microsoft.NETCore.App.Runtime.win-arm64 >= 8.0.0, <= 8.0.31 8.0.32
Microsoft.NETCore.App.Runtime.win-x64 >= 8.0.0, <= 8.0.31 8.0.32
Microsoft.NETCore.App.Runtime.win-x86 >= 8.0.0, <= 8.0.31 8.0.32
Microsoft.NETCore.App.Runtime.linux-arm >= 10.0.0, <= 10.0.12 10.0.13
Microsoft.NETCore.App.Runtime.linux-arm64 >= 10.0.0, <= 10.0.12 10.0.13
Microsoft.NETCore.App.Runtime.linux-musl-arm >= 10.0.0, <= 10.0.12 10.0.13
Microsoft.NETCore.App.Runtime.linux-musl-arm64 >= 10.0.0, <= 10.0.12 10.0.13
Microsoft.NETCore.App.Runtime.linux-musl-x64 >= 10.0.0, <= 10.0.12 10.0.13
Microsoft.NETCore.App.Runtime.linux-x64 >= 10.0.0, <= 10.0.12 10.0.13
Microsoft.NETCore.App.Runtime.osx-arm64 >= 10.0.0, <= 10.0.12 10.0.13
Microsoft.NETCore.App.Runtime.osx-x64 >= 10.0.0, <= 10.0.12 10.0.13
Microsoft.NETCore.App.Runtime.win-arm >= 10.0.0, <= 10.0.12 10.0.13
Microsoft.NETCore.App.Runtime.win-arm64 >= 10.0.0, <= 10.0.12 10.0.13
Microsoft.NETCore.App.Runtime.win-x64 >= 10.0.0, <= 10.0.12 10.0.13
Microsoft.NETCore.App.Runtime.win-x86 >= 10.0.0, <= 10.0.12 10.0.13
Microsoft.NETCore.App.Runtime.linux-arm >= 11.0.0-preview.1, <= 11.0.0-rc.1 11.0.0-rc.2
Microsoft.NETCore.App.Runtime.linux-arm64 >= 11.0.0-preview.1, <= 11.0.0-rc.1 11.0.0-rc.2
Microsoft.NETCore.App.Runtime.linux-musl-arm >= 11.0.0-preview.1, <= 11.0.0-rc.1 11.0.0-rc.2
Microsoft.NETCore.App.Runtime.linux-musl-arm64 >= 11.0.0-preview.1, <= 11.0.0-rc.1 11.0.0-rc.2
Microsoft.NETCore.App.Runtime.linux-musl-x64 >= 11.0.0-preview.1, <= 11.0.0-rc.1 11.0.0-rc.2
Microsoft.NETCore.App.Runtime.linux-x64 >= 11.0.0-preview.1, <= 11.0.0-rc.1 11.0.0-rc.2
Microsoft.NETCore.App.Runtime.osx-arm64 >= 11.0.0-preview.1, <= 11.0.0-rc.1 11.0.0-rc.2
Microsoft.NETCore.App.Runtime.osx-x64 >= 11.0.0-preview.1, <= 11.0.0-rc.1 11.0.0-rc.2
Microsoft.NETCore.App.Runtime.win-arm >= 11.0.0-preview.1, <= 11.0.0-rc.1 11.0.0-rc.2
Microsoft.NETCore.App.Runtime.win-arm64 >= 11.0.0-preview.1, <= 11.0.0-rc.1 11.0.0-rc.2
Microsoft.NETCore.App.Runtime.win-x64 >= 11.0.0-preview.1, <= 11.0.0-rc.1 11.0.0-rc.2
Microsoft.NETCore.App.Runtime.win-x86 >= 11.0.0-preview.1, <= 11.0.0-rc.1 11.0.0-rc.2

Advisory FAQ

How do I know if I am affected?

If using a package listed in affected packages, you're exposed to the vulnerability.

How do I fix the issue?

  1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.
  2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the dotnet --info command.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-58280

Acknowledgements

  • Leandro Batista

Revisions

V1.0 (10/13/2026): Advisory published.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.31"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.31"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.31"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.31"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.31"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.31"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.31"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.31"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.31"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.31"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.31"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.31"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.0.12"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.0.12"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.0.12"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.0.12"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.0.12"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.0.12"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.0.12"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.0.12"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.0.12"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.0.12"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.0.12"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.0.12"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.0.0-rc.1"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.0.0-rc.1"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.0.0-rc.1"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.0.0-rc.1"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.0.0-rc.1"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.0.0-rc.1"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.0.0-rc.1"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.0.0-rc.1"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.0.0-rc.1"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.0.0-rc.1"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.0.0-rc.1"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.0.0-rc.1"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.NETCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-preview.1"
            },
            {
              "fixed": "11.0.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-58280"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-13T20:01:59Z",
    "nvd_published_at": "2026-10-13T19:18:52Z",
    "severity": "HIGH"
  },
  "details": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml and System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nSigned XML fixes add input-depth and operation-count limits, prohibit DTD processing by default, validate entity references, bound encrypted-data candidate processing, and cap attributes and namespaces used by C14N transforms.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/447\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`\n\n- **Weakness:** CWE-674 (Uncontrolled Recursion)\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## \u003ca name=\"affected-packages\"\u003e\u003c/a\u003eAffected Packages\n\nThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | ---------------\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | \u003e= 9.0.0, \u003c= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | \u003e= 9.0.0, \u003c= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | \u003e= 9.0.0, \u003c= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | \u003e= 9.0.0, \u003c= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | \u003e= 9.0.0, \u003c= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | \u003e= 9.0.0, \u003c= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | \u003e= 9.0.0, \u003c= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | \u003e= 9.0.0, \u003c= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | \u003e= 9.0.0, \u003c= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | \u003e= 9.0.0, \u003c= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | \u003e= 9.0.0, \u003c= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | \u003e= 9.0.0, \u003c= 9.0.20 | 9.0.21\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | \u003e= 8.0.0, \u003c= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | \u003e= 8.0.0, \u003c= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | \u003e= 8.0.0, \u003c= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | \u003e= 8.0.0, \u003c= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | \u003e= 8.0.0, \u003c= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | \u003e= 8.0.0, \u003c= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | \u003e= 8.0.0, \u003c= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | \u003e= 8.0.0, \u003c= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | \u003e= 8.0.0, \u003c= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | \u003e= 8.0.0, \u003c= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | \u003e= 8.0.0, \u003c= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | \u003e= 8.0.0, \u003c= 8.0.31 | 8.0.32\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | \u003e= 10.0.0, \u003c= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | \u003e= 10.0.0, \u003c= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | \u003e= 10.0.0, \u003c= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | \u003e= 10.0.0, \u003c= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | \u003e= 10.0.0, \u003c= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | \u003e= 10.0.0, \u003c= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | \u003e= 10.0.0, \u003c= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | \u003e= 10.0.0, \u003c= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | \u003e= 10.0.0, \u003c= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | \u003e= 10.0.0, \u003c= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | \u003e= 10.0.0, \u003c= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | \u003e= 10.0.0, \u003c= 10.0.12 | 10.0.13\n[Microsoft.NETCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm) | \u003e= 11.0.0-preview.1, \u003c= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-arm64) | \u003e= 11.0.0-preview.1, \u003c= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm) | \u003e= 11.0.0-preview.1, \u003c= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-arm64) | \u003e= 11.0.0-preview.1, \u003c= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-musl-x64) | \u003e= 11.0.0-preview.1, \u003c= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.linux-x64) | \u003e= 11.0.0-preview.1, \u003c= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-arm64) | \u003e= 11.0.0-preview.1, \u003c= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.osx-x64) | \u003e= 11.0.0-preview.1, \u003c= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm) | \u003e= 11.0.0-preview.1, \u003c= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | \u003e= 11.0.0-preview.1, \u003c= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | \u003e= 11.0.0-preview.1, \u003c= 11.0.0-rc.1 | 11.0.0-rc.2\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | \u003e= 11.0.0-preview.1, \u003c= 11.0.0-rc.1 | 11.0.0-rc.2\n\n## Advisory FAQ\n\n### \u003ca name=\"how-affected\"\u003e\u003c/a\u003eHow do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you\u0027re exposed to the vulnerability.\n\n### \u003ca name=\"how-fix\"\u003e\u003c/a\u003eHow do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you\u0027ve deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-58280](https://www.cve.org/CVERecord?id=CVE-2026-58280)\n\n### Acknowledgements\n\n- Leandro Batista\n\n### Revisions\n\nV1.0 (10/13/2026): Advisory published.",
  "id": "GHSA-mc4q-93x5-f6hj",
  "modified": "2026-10-19T19:17:32Z",
  "published": "2026-10-13T20:01:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/runtime/security/advisories/GHSA-mc4q-93x5-f6hj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58280"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/announcements/issues/447"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/runtime/issues/135696"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dotnet/runtime"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58280"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability"
}

GHSA-MCGJ-MGJ8-8CR3

Vulnerability from github – Published: 2022-05-13 01:53 – Updated: 2022-05-13 01:53
VLAI
Details

libqpdf.a in QPDF through 8.0.2 mishandles certain "expected dictionary key but found non-name object" cases, allowing remote attackers to cause a denial of service (stack exhaustion), related to the QPDFObjectHandle and QPDF_Dictionary classes, because nesting in direct objects is not restricted.

Severity
7.8 (High)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-9918"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-04-10T18:29:00Z",
    "severity": "HIGH"
  },
  "details": "libqpdf.a in QPDF through 8.0.2 mishandles certain \"expected dictionary key but found non-name object\" cases, allowing remote attackers to cause a denial of service (stack exhaustion), related to the QPDFObjectHandle and QPDF_Dictionary classes, because nesting in direct objects is not restricted.",
  "id": "GHSA-mcgj-mgj8-8cr3",
  "modified": "2022-05-13T01:53:58Z",
  "published": "2022-05-13T01:53:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9918"
    },
    {
      "type": "WEB",
      "url": "https://github.com/qpdf/qpdf/issues/202"
    },
    {
      "type": "WEB",
      "url": "https://github.com/qpdf/qpdf/commit/b4d6cf6836ce025ba1811b7bbec52680c7204223"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3638-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MCMR-G7GG-P242

Vulnerability from github – Published: 2026-07-29 18:31 – Updated: 2026-07-29 18:31
VLAI
Details

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc_search_key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc_search_andlist() and alloc_search_notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-67194"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-29T17:16:54Z",
    "severity": "HIGH"
  },
  "details": "Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser (alloc_search_key in searchinfo.C) recursively descends on nested parenthesized groups through a mutual recursion chain with alloc_search_andlist() and alloc_search_notkey(), with no depth limit. Courier IMAP has no overall command line length limit, making exploitation trivial. A single IMAP command with ~2500 nested parentheses overflows the 8MB default stack, causing SIGSEGV.",
  "id": "GHSA-mcmr-g7gg-p242",
  "modified": "2026-07-29T18:31:40Z",
  "published": "2026-07-29T18:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67194"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svarshavchik/courier-libs/commit/b5b5581aabea3efadf5e2944947ff0214aa3533e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svarshavchik/courier/releases/tag/courier%2F2.0.2%2F20260627214309"
    },
    {
      "type": "WEB",
      "url": "https://github.com/svarshavchik/courier/releases/tag/courier-imap%2F6.0.1%2F20260627214444"
    },
    {
      "type": "WEB",
      "url": "https://packages.debian.org/sid/courier-imap"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/courier-imap-mail-server-stack-overflow-dos-via-nested-search-queries"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-MHPP-875W-9CPV

Vulnerability from github – Published: 2018-01-22 13:32 – Updated: 2025-09-02 22:35
VLAI
Summary
Denial of Service in jquery
Details

Affected versions of jquery use a lowercasing logic on attribute names. When given a boolean attribute with a name that contains uppercase characters, jquery enters into an infinite recursion loop, exceeding the call stack limit, and resulting in a denial of service condition.

Recommendation

Update to version 3.0.0 or later.

Severity
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "jquery"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0-rc.1"
            },
            {
              "fixed": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.0.0-rc.1"
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "jQuery"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0-rc.1"
            },
            {
              "fixed": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.0.0-rc.1"
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.webjars.npm:jquery"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0-rc1"
            },
            {
              "fixed": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.0.0-rc1"
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "jquery-rails"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0-rc.1"
            },
            {
              "fixed": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.0.0-rc.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2016-10707"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:46:22Z",
    "nvd_published_at": "2018-01-18T23:29:00Z",
    "severity": "HIGH"
  },
  "details": "Affected versions of `jquery` use a lowercasing logic on attribute names. When given a boolean attribute with a name that contains uppercase characters, `jquery` enters into an infinite recursion loop, exceeding the call stack limit, and resulting in a denial of service condition.\n\n\n## Recommendation\n\nUpdate to version 3.0.0 or later.",
  "id": "GHSA-mhpp-875w-9cpv",
  "modified": "2025-09-02T22:35:01Z",
  "published": "2018-01-22T13:32:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10707"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jquery/jquery/issues/3133"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jquery/jquery/issues/3133#issuecomment-358978489"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jquery/jquery/pull/3134"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-mhpp-875w-9cpv"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jquery/jquery"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2016-10707.yml"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/npm:jquery:20160529"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/330"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Denial of Service in jquery"
}

GHSA-MHWH-83QC-J6X4

Vulnerability from github – Published: 2026-06-23 18:31 – Updated: 2026-06-23 18:31
VLAI
Details

MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-71382"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-23T18:17:41Z",
    "severity": "HIGH"
  },
  "details": "MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering.",
  "id": "GHSA-mhwh-83qc-j6x4",
  "modified": "2026-06-23T18:31:43Z",
  "published": "2026-06-23T18:31:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71382"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ArtifexSoftware/mupdf/commit/70b71ab22e6de4d4c44cd301c88231f623a4e94e"
    },
    {
      "type": "WEB",
      "url": "https://bugs.ghostscript.com/show_bug.cgi?id=708840"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ArtifexSoftware/mupdf/releases/tag/1.27.0-rc1"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/mupdf-rc1-stack-exhaustion-dos-via-epub-css-rendering"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-MJRG-RF9G-9J6R

Vulnerability from github – Published: 2022-05-13 01:22 – Updated: 2022-05-13 01:22
VLAI
Details

An issue was discovered in the function expr6 in eval.c in Netwide Assembler (NASM) through 2.14.02. There is a stack exhaustion problem caused by the expr6 function making recursive calls to itself in certain scenarios involving lots of '!' or '+' or '-' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted asm file.

Severity
5.5 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-6291"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-01-15T00:29:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in the function expr6 in eval.c in Netwide Assembler (NASM) through 2.14.02. There is a stack exhaustion problem caused by the expr6 function making recursive calls to itself in certain scenarios involving lots of \u0027!\u0027 or \u0027+\u0027 or \u0027-\u0027 characters. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted asm file.",
  "id": "GHSA-mjrg-rf9g-9j6r",
  "modified": "2022-05-13T01:22:40Z",
  "published": "2022-05-13T01:22:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6291"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.nasm.us/show_bug.cgi?id=3392549"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MMPX-JCFP-P3WG

Vulnerability from github – Published: 2026-08-13 21:36 – Updated: 2026-08-13 21:36
VLAI
Details

Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated against a sufficiently long name, exhausts the thread stack. Elasticsearch treats a stack overflow as an unrecoverable condition and shuts the node down, so the request terminates the affected node rather than failing gracefully.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-72636"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-13T20:17:24Z",
    "severity": "MODERATE"
  },
  "details": "Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated against a sufficiently long name, exhausts the thread stack. Elasticsearch treats a stack overflow as an unrecoverable condition and shuts the node down, so the request terminates the affected node rather than failing gracefully.",
  "id": "GHSA-mmpx-jcfp-p3wg",
  "modified": "2026-08-13T21:36:07Z",
  "published": "2026-08-13T21:36:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72636"
    },
    {
      "type": "WEB",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-133/389499"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Implementation

Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.

Mitigation
Implementation

Increase the stack size.

CAPEC-230: Serialized Data with Nested Payloads

Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization.

CAPEC-231: Oversized Serialized Data Payloads

An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.

← Back to the CWE list