Common Weakness Enumeration
CWE-674
Allowed-with-ReviewUncontrolled Recursion
Abstraction: Class · Status: Draft
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
900 vulnerabilities reference this CWE, most recent first.
CVE-2026-110263 (GCVE-0-2026-110263)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 16:12
VLAI
EPSS
VEX
Title
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader
Summary
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type arguments to trigger a StackOverflowError during class transformation, causing denial of service.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 16:11 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gitlab.ow2.org/asm/asm/-/merge_requests/465 | patch |
| https://gitlab.ow2.org/asm/asm/-/commit/8f87fc031… | patch |
| https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/… | technical-description |
| https://asm.ow2.io/versions.html | release-notes |
| https://www.vulncheck.com/advisories/ow2-asm-3.0-… | third-party-advisory |
Date Public
2026-09-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110263",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T16:11:44.598486Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:12:42.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.ow2.asm/asm",
"product": "ASM",
"repo": "https://gitlab.ow2.org/asm/asm",
"vendor": "OW2",
"versions": [
{
"lessThan": "9.11",
"status": "affected",
"version": "3.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eric Bruneton"
}
],
"datePublic": "2026-09-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type arguments to trigger a StackOverflowError during class transformation, causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:16:34.949Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://gitlab.ow2.org/asm/asm/-/merge_requests/465"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.ow2.org/asm/asm/-/commit/8f87fc0317a4c5ee8f538bcbb641928def25dbd6"
},
{
"tags": [
"technical-description"
],
"url": "https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/signature/SignatureReader.java#L151"
},
{
"name": "ASM 9.11 Release Notes",
"tags": [
"release-notes"
],
"url": "https://asm.ow2.io/versions.html"
},
{
"name": "VulnCheck Advisory: OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-uncontrolled-recursion-in-signaturereader"
}
],
"title": "OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110263",
"datePublished": "2026-10-14T14:16:34.949Z",
"dateReserved": "2026-10-13T18:33:55.549Z",
"dateUpdated": "2026-10-14T16:12:42.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110259 (GCVE-0-2026-110259)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 14:16
VLAI
EPSS
VEX
Title
OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()
Summary
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded toByteArray() recursion and a StackOverflowError during transformation.
Severity
5.5 (Medium)
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gitlab.ow2.org/asm/asm/-/merge_requests/459 | patch |
| https://gitlab.ow2.org/asm/asm/-/commit/e9aca627c… | patch |
| https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/… | technical-description |
| https://asm.ow2.io/versions.html | release-notes |
| https://www.vulncheck.com/advisories/ow2-asm-3.0-… | third-party-advisory |
Date Public
2026-08-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.ow2.asm/asm",
"product": "ASM",
"repo": "https://gitlab.ow2.org/asm/asm",
"vendor": "OW2",
"versions": [
{
"lessThan": "9.11",
"status": "affected",
"version": "3.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eric Bruneton"
}
],
"datePublic": "2026-08-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded toByteArray() recursion and a StackOverflowError during transformation."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:16:32.252Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://gitlab.ow2.org/asm/asm/-/merge_requests/459"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.ow2.org/asm/asm/-/commit/e9aca627c17e1619bcb8059afb43382dac6b275f"
},
{
"tags": [
"technical-description"
],
"url": "https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/ClassWriter.java#L751"
},
{
"name": "ASM 9.11 Release Notes",
"tags": [
"release-notes"
],
"url": "https://asm.ow2.io/versions.html"
},
{
"name": "VulnCheck Advisory: OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-uncontrolled-recursion-via-classwriter-replaceasminstructions"
}
],
"title": "OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110259",
"datePublished": "2026-10-14T14:16:32.252Z",
"dateReserved": "2026-10-13T18:33:55.549Z",
"dateUpdated": "2026-10-14T14:16:32.252Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109449 (GCVE-0-2026-109449)
Vulnerability from cvelistv5 – Published: 2026-10-15 15:19 – Updated: 2026-10-15 18:05
VLAI
EPSS
VEX
Title
Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
Summary
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.
#[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.
This issue affects symfony/expression-language through v5.4.53, v6.0.0-BETA1 through v6.4.47, v7.0.0-BETA1 through v7.4.20, and v8.0.0-BETA1 through v8.1.8.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:05 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/symfony/symfony/security/advis… | third-party-advisory |
| https://symfony.com/blog/cve-2026-109449-unbounde… | vendor-advisory |
| https://github.com/symfony/symfony/pull/65690 | patch |
| https://github.com/symfony/symfony/pull/66720 | patch |
| https://github.com/symfony/symfony/pull/66723 | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sensiolabs | symfony |
Affected:
0 , < v5.4.54
(git)
Affected: v6.0.0-BETA1 , < v6.4.48 (git) Affected: v7.0.0-BETA1 , < v7.4.21 (git) Affected: v8.0.0-BETA1 , < v8.1.9 (git) cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109449",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:05:16.968511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:05:32.422Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/packages/symfony/expression-language",
"defaultStatus": "unaffected",
"modules": [
"ExpressionLanguage::lint()"
],
"packageName": "symfony/expression-language",
"product": "symfony",
"repo": "https://github.com/symfony/expression-language",
"vendor": "sensiolabs",
"versions": [
{
"lessThan": "v5.4.54",
"status": "affected",
"version": "0",
"versionType": "git"
},
{
"lessThan": "v6.4.48",
"status": "affected",
"version": "v6.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v7.4.21",
"status": "affected",
"version": "v7.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v8.1.9",
"status": "affected",
"version": "v8.0.0-BETA1",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v5.4.54",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v6.4.48",
"versionStartIncluding": "v6.0.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v7.4.21",
"versionStartIncluding": "v7.0.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v8.1.9",
"versionStartIncluding": "v8.0.0-beta1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Nicolas Grekas"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In\u0026nbsp;\u003cspan\u003eSymfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9,\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.\u003c/span\u003e\u003cdiv\u003e\u003ccode\u003e\u003cbr\u003e\u003c/code\u003e\u003c/div\u003e\u003cdiv\u003e\u003ccode\u003e#[Assert\\ExpressionSyntax]\u003c/code\u003e\u003cspan\u003e passes the validated value to \u003c/span\u003e\u003ccode\u003eExpressionLanguage::lint()\u003c/code\u003e\u003cspan\u003e, so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eThis issue affects \u003c/span\u003e\u003ccode\u003esymfony/expression-language\u003c/code\u003e\u003cspan\u003e\u0026nbsp;through v5.4.53, v6.0.0-BETA1\u0026nbsp;\u003c/span\u003ethrough\u003cspan\u003e\u0026nbsp;v6.4.47, v7.0.0-BETA1\u0026nbsp;\u003c/span\u003ethrough\u003cspan\u003e\u0026nbsp;v7.4.20, and v8.0.0-BETA1\u0026nbsp;\u003c/span\u003ethrough\u003cspan\u003e\u0026nbsp;v8.1.8.\u003c/span\u003e\u003c/div\u003e"
}
],
"value": "In\u00a0Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9,\u00a0the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed.\n\n\n#[Assert\\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application validating expressions written by its users could be crashed by a single request, and so could any code parsing untrusted expressions.\n\nThis issue affects symfony/expression-language\u00a0through v5.4.53, v6.0.0-BETA1\u00a0through\u00a0v6.4.47, v7.0.0-BETA1\u00a0through\u00a0v7.4.20, and v8.0.0-BETA1\u00a0through\u00a0v8.1.8."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:30:42.730Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-7rpj-w9pf-39rr"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://symfony.com/blog/cve-2026-109449-unbounded-nesting-in-the-expression-parser-lets-untrusted-expressions-crash-the-process"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/pull/65690"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/pull/66720"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/pull/66723"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-109449",
"datePublished": "2026-10-15T15:19:08.663Z",
"dateReserved": "2026-10-12T16:57:32.590Z",
"dateUpdated": "2026-10-15T18:05:32.422Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109413 (GCVE-0-2026-109413)
Vulnerability from cvelistv5 – Published: 2026-10-15 14:57 – Updated: 2026-10-15 18:06
VLAI
EPSS
VEX
Title
Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
Summary
In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error.
Any code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough.
This issue affects symfony/yaml through v5.4.53, v6.0.0-BETA1 through v6.4.44, v7.0.0-BETA1 through v7.4.17, and v8.0.0-BETA1 through v8.1.5.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:06 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/symfony/symfony/security/advis… | third-party-advisory |
| https://symfony.com/blog/cve-2026-109413-unbounde… | vendor-advisory |
| https://github.com/symfony/symfony/pull/65688 | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sensiolabs | symfony |
Affected:
0 , < v5.4.54
(git)
Affected: v6.0.0-BETA1 , < v6.4.45 (git) Affected: v7.0.0-BETA1 , < v7.4.18 (git) Affected: v8.0.0-BETA1 , < v8.1.6 (git) cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109413",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:06:37.552332Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:06:55.183Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/packages/symfony/yaml",
"defaultStatus": "unaffected",
"modules": [
"Symfony\\\\Component\\\\Yaml\\\\Parser::lexInlineStructure()"
],
"packageName": "symfony/yaml",
"product": "symfony",
"repo": "https://github.com/symfony/yaml",
"vendor": "sensiolabs",
"versions": [
{
"lessThan": "v5.4.54",
"status": "affected",
"version": "0",
"versionType": "git"
},
{
"lessThan": "v6.4.45",
"status": "affected",
"version": "v6.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v7.4.18",
"status": "affected",
"version": "v7.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v8.1.6",
"status": "affected",
"version": "v8.0.0-BETA1",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v5.4.54",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v6.4.45",
"versionStartIncluding": "v6.0.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v7.4.18",
"versionStartIncluding": "v7.0.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v8.1.6",
"versionStartIncluding": "v8.0.0-beta1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Nicolas Grekas"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Symfony YAML prior to versions\u0026nbsp;\u003cspan\u003e5.4.54,\u0026nbsp;\u003c/span\u003e\u003cspan\u003e6.4.45,\u0026nbsp;\u003c/span\u003e\u003cspan\u003e7.4.18, and\u0026nbsp;\u003c/span\u003e\u003cspan\u003e8.1.6,\u0026nbsp;\u003c/span\u003e\u003ccode\u003eYaml\\Parser::lexInlineStructure()\u003c/code\u003e\u003cspan\u003e recursed through \u003c/span\u003e\u003ccode\u003elexInlineMapping()\u003c/code\u003e\u003cspan\u003e and \u003c/span\u003e\u003ccode\u003elexInlineSequence()\u003c/code\u003e\u003cspan\u003e for every \u003c/span\u003e\u003ccode\u003e{\u003c/code\u003e\u003cspan\u003e and \u003c/span\u003e\u003ccode\u003e[\u003c/code\u003e\u003cspan\u003e of an inline collection, without entering the nesting level that the rest of the parser bounds with \u003c/span\u003e\u003ccode\u003emaxNestingLevel\u003c/code\u003e\u003cspan\u003e. A document made of deeply nested inline collections, such as \u003c/span\u003e\u003ccode\u003e[[[[...]]]]\u003c/code\u003e\u003cspan\u003e, exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error.\u003c/span\u003e\u003c/p\u003e\u003cp\u003eAny code parsing untrusted YAML is affected. That includes \u003ccode\u003e#[MapRequestPayload]\u003c/code\u003e when the Yaml component is installed and the endpoint does not restrict \u003ccode\u003eacceptFormat\u003c/code\u003e: a single unauthenticated request with a YAML content type is enough.\u003c/p\u003e\u003cp\u003eThis issue affects \u003ccode\u003esymfony/yaml\u003c/code\u003e\u0026nbsp;through v5.4.53, v6.0.0-BETA1 through\u0026nbsp;v6.4.44, v7.0.0-BETA1 through\u0026nbsp;v7.4.17, and v8.0.0-BETA1 through\u0026nbsp;v8.1.5.\u003c/p\u003e"
}
],
"value": "In Symfony YAML prior to versions\u00a05.4.54,\u00a06.4.45,\u00a07.4.18, and\u00a08.1.6,\u00a0Yaml\\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error.\n\n\n\nAny code parsing untrusted YAML is affected. That includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat: a single unauthenticated request with a YAML content type is enough.\n\n\n\nThis issue affects symfony/yaml\u00a0through v5.4.53, v6.0.0-BETA1 through\u00a0v6.4.44, v7.0.0-BETA1 through\u00a0v7.4.17, and v8.0.0-BETA1 through\u00a0v8.1.5."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:29:00.531Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-2v3c-qxhr-7vpv"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://symfony.com/blog/cve-2026-109413-unbounded-recursion-in-the-yaml-inline-lexer-lets-a-single-document-crash-the-process"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/pull/65688"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-109413",
"datePublished": "2026-10-15T14:57:00.211Z",
"dateReserved": "2026-10-12T15:28:55.069Z",
"dateUpdated": "2026-10-15T18:06:55.183Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109267 (GCVE-0-2026-109267)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-15 02:33
VLAI
EPSS
VEX
Title
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder
Summary
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 02:33 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ImageMagick/ImageMagick/securi… | vendor-advisory |
| https://github.com/ImageMagick/ImageMagick/commit… | patch |
| https://github.com/ImageMagick/ImageMagick6/commi… | patch |
| https://www.vulncheck.com/advisories/imagemagick-… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ImageMagick | ImageMagick |
Affected:
7.0.0-0 , < 7.1.2-32
(custom)
Unaffected: 7.1.2-32 (custom) |
|
| ImageMagick | ImageMagick |
Affected:
0 , < 6.9.13-57
(custom)
Unaffected: 6.9.13-57 (custom) |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109267",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T02:33:49.798707Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T02:33:58.753Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ImageMagick",
"vendor": "ImageMagick",
"versions": [
{
"lessThan": "7.1.2-32",
"status": "affected",
"version": "7.0.0-0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.1.2-32",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ImageMagick",
"vendor": "ImageMagick",
"versions": [
{
"lessThan": "6.9.13-57",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.9.13-57",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.2-32",
"versionStartIncluding": "7.0.0-0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.13-57",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kushalkhemka"
},
{
"lang": "en",
"type": "finder",
"value": "opensec-intelligence"
},
{
"lang": "en",
"type": "finder",
"value": "mayank-jangid-moon"
},
{
"lang": "en",
"type": "finder",
"value": "skigeek16"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:35.334Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-462x-739v-qvq2)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-462x-739v-qvq2"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ImageMagick/ImageMagick/commit/507aee2308046b25e251d0be1a5371327bb79683"
},
{
"name": "ImageMagick6 Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ImageMagick/ImageMagick6/commit/c10823904b251d07fe79346a7136b0af295d451b"
},
{
"name": "VulnCheck Advisory: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-msl-decoder"
}
],
"title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109267",
"datePublished": "2026-10-12T16:04:35.334Z",
"dateReserved": "2026-10-12T14:11:07.804Z",
"dateUpdated": "2026-10-15T02:33:58.753Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109264 (GCVE-0-2026-109264)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-13 16:56
VLAI
EPSS
VEX
Title
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder
Summary
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:49 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ImageMagick/ImageMagick/securi… | vendor-advisory |
| https://github.com/ImageMagick/ImageMagick/commit… | patch |
| https://github.com/ImageMagick/ImageMagick6/commi… | patch |
| https://www.vulncheck.com/advisories/imagemagick-… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ImageMagick | ImageMagick |
Affected:
7.0.0-0 , < 7.1.2-32
(custom)
Unaffected: 7.1.2-32 (custom) |
|
| ImageMagick | ImageMagick |
Affected:
0 , < 6.9.13-57
(custom)
Unaffected: 6.9.13-57 (custom) |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109264",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:49:15.633228Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:56:22.060Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ImageMagick",
"vendor": "ImageMagick",
"versions": [
{
"lessThan": "7.1.2-32",
"status": "affected",
"version": "7.0.0-0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.1.2-32",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ImageMagick",
"vendor": "ImageMagick",
"versions": [
{
"lessThan": "6.9.13-57",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.9.13-57",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.2-32",
"versionStartIncluding": "7.0.0-0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.13-57",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "manus-pi"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:33.287Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-pmqj-84pr-qc7c)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmqj-84pr-qc7c"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ImageMagick/ImageMagick/commit/6ff963c14ccb5fefb4eb8654c8b0219033df2b20"
},
{
"name": "ImageMagick6 Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ImageMagick/ImageMagick6/commit/d4f06dcca7ad99d639af85bc347ad9fdfdcec8e2"
},
{
"name": "VulnCheck Advisory: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-57-and-7-x-before-7.1.2-32-stack-overflow-in-mvg-decoder"
}
],
"title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109264",
"datePublished": "2026-10-12T16:04:33.287Z",
"dateReserved": "2026-10-12T14:10:14.200Z",
"dateUpdated": "2026-10-13T16:56:22.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107833 (GCVE-0-2026-107833)
Vulnerability from cvelistv5 – Published: 2026-10-09 17:39 – Updated: 2026-10-09 18:02
VLAI
EPSS
VEX
Title
OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion
Summary
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. Request JSON processing is not affected by this specific path because it uses the configured request recursion limit, and exploitation requires response-body inspection to be enabled. This issue is fixed in version 3.8.0.
Severity
5.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 18:01 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/corazawaf/coraza/security/advi… | x_refsource_CONFIRM |
| https://github.com/corazawaf/coraza/commit/cae3c7… | x_refsource_MISC |
| https://github.com/corazawaf/coraza/releases/tag/v3.8.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107833",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T18:01:32.504807Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T18:02:08.775Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/corazawaf/coraza/security/advisories/GHSA-3c6w-j9xm-8h2h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "coraza",
"vendor": "corazawaf",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.8.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. Request JSON processing is not affected by this specific path because it uses the configured request recursion limit, and exploitation requires response-body inspection to be enabled. This issue is fixed in version 3.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:39:48.049Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/corazawaf/coraza/security/advisories/GHSA-3c6w-j9xm-8h2h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/corazawaf/coraza/security/advisories/GHSA-3c6w-j9xm-8h2h"
},
{
"name": "https://github.com/corazawaf/coraza/commit/cae3c7407e7b84372c207033de03f15f89bf351a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/corazawaf/coraza/commit/cae3c7407e7b84372c207033de03f15f89bf351a"
},
{
"name": "https://github.com/corazawaf/coraza/releases/tag/v3.8.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/corazawaf/coraza/releases/tag/v3.8.0"
}
],
"source": {
"advisory": "GHSA-3c6w-j9xm-8h2h",
"discovery": "UNKNOWN"
},
"title": "OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107833",
"datePublished": "2026-10-09T17:39:48.049Z",
"dateReserved": "2026-10-08T22:34:49.288Z",
"dateUpdated": "2026-10-09T18:02:08.775Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107826 (GCVE-0-2026-107826)
Vulnerability from cvelistv5 – Published: 2026-10-09 17:33 – Updated: 2026-10-09 17:55
VLAI
EPSS
VEX
Title
OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
Summary
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An unauthenticated attacker can submit shallow values followed by an extremely deeply nested JSON tail that was not visited by the bounded walk, causing gjson.Valid to recurse without a depth bound and terminate the hosting process with an unrecoverable fatal stack overflow. The ProcessRequest and ProcessResponse JSON paths share the affected readJSON validation flow, and the payload can remain within recommended body-size and argument-count limits. This issue is fixed in version 3.8.1.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 17:55 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/corazawaf/coraza/security/advi… | x_refsource_CONFIRM |
| https://github.com/corazawaf/coraza/commit/814e18… | x_refsource_MISC |
| https://github.com/corazawaf/coraza/releases/tag/v3.8.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107826",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T17:55:09.069803Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:55:14.751Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/corazawaf/coraza/security/advisories/GHSA-6gcq-wc29-5xf2"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "coraza",
"vendor": "corazawaf",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.8.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An unauthenticated attacker can submit shallow values followed by an extremely deeply nested JSON tail that was not visited by the bounded walk, causing gjson.Valid to recurse without a depth bound and terminate the hosting process with an unrecoverable fatal stack overflow. The ProcessRequest and ProcessResponse JSON paths share the affected readJSON validation flow, and the payload can remain within recommended body-size and argument-count limits. This issue is fixed in version 3.8.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T17:33:49.389Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/corazawaf/coraza/security/advisories/GHSA-6gcq-wc29-5xf2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/corazawaf/coraza/security/advisories/GHSA-6gcq-wc29-5xf2"
},
{
"name": "https://github.com/corazawaf/coraza/commit/814e1898e083d2ff2ceb644382d0da17e930f93f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/corazawaf/coraza/commit/814e1898e083d2ff2ceb644382d0da17e930f93f"
},
{
"name": "https://github.com/corazawaf/coraza/releases/tag/v3.8.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/corazawaf/coraza/releases/tag/v3.8.1"
}
],
"source": {
"advisory": "GHSA-6gcq-wc29-5xf2",
"discovery": "UNKNOWN"
},
"title": "OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107826",
"datePublished": "2026-10-09T17:33:49.389Z",
"dateReserved": "2026-10-08T21:23:59.824Z",
"dateUpdated": "2026-10-09T17:55:14.751Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107678 (GCVE-0-2026-107678)
Vulnerability from cvelistv5 – Published: 2026-10-08 15:28 – Updated: 2026-10-08 17:51
VLAI
EPSS
VEX
Title
FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes
Summary
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 15:35 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593 | issue-tracking |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/liba… | technical-description |
| https://ffmpeg.org/ | product |
| https://www.vulncheck.com/advisories/ffmpeg-throu… | third-party-advisory |
Impacted products
Date Public
2026-09-21 00:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107678",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T15:35:36.075279Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T17:51:49.706Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"product": "FFmpeg",
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"versions": [
{
"lessThanOrEqual": "9.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua Rogers (AISLE Research)"
}
],
"datePublic": "2026-09-21T00:26:13.000Z",
"descriptions": [
{
"lang": "en",
"value": "FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer\u0027s mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T15:28:43.274Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070"
},
{
"tags": [
"product"
],
"url": "https://ffmpeg.org/"
},
{
"name": "VulnCheck Advisory: FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes"
}
],
"title": "FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107678",
"datePublished": "2026-10-08T15:28:43.274Z",
"dateReserved": "2026-10-08T15:11:28.450Z",
"dateUpdated": "2026-10-08T17:51:49.706Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107376 (GCVE-0-2026-107376)
Vulnerability from cvelistv5 – Published: 2026-10-08 17:49 – Updated: 2026-10-08 18:39
VLAI
EPSS
VEX
Title
webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested input
Summary
webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, object or list values, or list types that exhaust the PHP process stack during pre-validation parsing, before query validation and complexity controls run. The resulting SIGSEGV can terminate PHP-FPM workers or long-running Swoole, RoadRunner, ReactPHP, or CLI processes and cannot be caught by application-level exception handling. This issue is fixed in version 15.32.3.
Severity
8.2 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 18:39 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/webonyx/graphql-php/security/a… | x_refsource_CONFIRM |
| https://github.com/webonyx/graphql-php/commit/6c1… | x_refsource_MISC |
| https://github.com/webonyx/graphql-php/commit/7b7… | x_refsource_MISC |
| https://github.com/webonyx/graphql-php/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| webonyx | graphql-php |
Affected:
< 15.32.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107376",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T18:39:30.355689Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T18:39:56.356Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/webonyx/graphql-php/security/advisories/GHSA-r7cg-qjjm-xhqq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "graphql-php",
"vendor": "webonyx",
"versions": [
{
"status": "affected",
"version": "\u003c 15.32.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\\Language\\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, object or list values, or list types that exhaust the PHP process stack during pre-validation parsing, before query validation and complexity controls run. The resulting SIGSEGV can terminate PHP-FPM workers or long-running Swoole, RoadRunner, ReactPHP, or CLI processes and cannot be caught by application-level exception handling. This issue is fixed in version 15.32.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T17:49:57.113Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/webonyx/graphql-php/security/advisories/GHSA-r7cg-qjjm-xhqq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/webonyx/graphql-php/security/advisories/GHSA-r7cg-qjjm-xhqq"
},
{
"name": "https://github.com/webonyx/graphql-php/commit/6c1d6009a0f7557f66753bcfd07badd15acf77f4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/webonyx/graphql-php/commit/6c1d6009a0f7557f66753bcfd07badd15acf77f4"
},
{
"name": "https://github.com/webonyx/graphql-php/commit/7b7f2080ca5f7d5340a696fc5701b19a9222d2c2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/webonyx/graphql-php/commit/7b7f2080ca5f7d5340a696fc5701b19a9222d2c2"
},
{
"name": "https://github.com/webonyx/graphql-php/releases/tag/v15.32.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/webonyx/graphql-php/releases/tag/v15.32.3"
}
],
"source": {
"advisory": "GHSA-r7cg-qjjm-xhqq",
"discovery": "UNKNOWN"
},
"title": "webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested input"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107376",
"datePublished": "2026-10-08T17:49:57.113Z",
"dateReserved": "2026-10-07T21:07:54.987Z",
"dateUpdated": "2026-10-08T18:39:56.356Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
Mitigation
Implementation
Increase the stack size.
CAPEC-230: Serialized Data with Nested Payloads
Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization.
CAPEC-231: Oversized Serialized Data Payloads
An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.