By weakness (CWE)

CWE-674: related vulnerabilities

CVEs classified under CWE-674. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

27 published vulnerabilities

• CVE-2026-53202HIGH 7.8

  A vulnerability in the Linux kernel's Intel VPU (accel/ivpu) driver can cause a stack buffer overflow when processing firmware-supplied data. The issue stems from a signed/unsigned integer mismatch: the driver receives a data size value from firmware (unsigned), but casts it to a signed integer before using it in a min operation. If the firmware provides a large value (≥2GB), the signed cast causes it to become negative, which can lead to incorrect buffer size calculations and oversized memory copies that overflow the stack. An attacker with local access and appropriate privileges could exploit this to cause a kernel crash or potentially execute arbitrary code.

• CVE-2026-53267HIGH 7.8

  A flaw in the Linux kernel's netfilter connection tracking (nft_ct) module allows a local attacker with unprivileged access to write code to kernel memory and crash the system. The issue occurs when firewall rules interact with template connection tracking objects in an unexpected way, causing a memory copy operation to overflow its bounds and corrupt adjacent kernel memory structures. The vulnerability requires local access and the ability to create firewall rules, but doesn't require elevated privileges to trigger.

• CVE-2026-46373HIGH 7.5

  SQLFluff, a popular SQL linter and code formatter, contains a denial-of-service vulnerability in versions before 4.1.0. An attacker who can submit SQL queries to an application using SQLFluff's parser can craft a specially nested query to exhaust system resources, causing the application to become unresponsive or crash. This affects any deployment where untrusted users have the ability to lint arbitrary SQL code.

• CVE-2026-48502HIGH 7.5

  MessagePack for C# versions before 2.5.301 and 3.1.7 contain a critical memory management vulnerability in the timestamp parsing logic. When processing specially crafted MessagePack messages, the library allocates stack memory based on attacker-supplied values without first validating those values are legitimate. This can trigger a stack overflow that crashes the entire application with no opportunity for error handling. An attacker can exploit this remotely with a tiny payload to take down services using vulnerable versions of the library.

• CVE-2026-48506HIGH 7.5

  MessagePack for C# versions before 2.5.301 and 3.1.7 contain a flaw in the TrySkip() function that allows deeply nested data structures to bypass the library's built-in depth-checking protection. When the serializer encounters data it needs to skip—such as unknown fields or unrecognized map keys—it recursively processes nested structures without respecting the configured maximum object graph depth limit. An attacker who sends a specially crafted MessagePack payload with extreme nesting can trigger an unrecoverable stack overflow, causing the application to crash. This is a denial-of-service vulnerability affecting any .NET application using vulnerable versions of MessagePack.

• CVE-2026-48512HIGH 7.5

  MessagePack for C# contains multiple unguarded recursion paths in its JSON conversion helpers that allow attackers to trigger stack exhaustion. When processing nested JSON structures or even malformed JSON with repeated separators, the library fails to enforce depth limits consistently, leading to an uncatchable StackOverflowException that crashes the process. This is a denial-of-service vulnerability affecting applications that use MessagePack to deserialize or convert JSON from untrusted sources.

• CVE-2026-48513HIGH 7.5

  MessagePack for C# versions before 2.5.301 and 3.1.7 contain a flaw in how they deserialize union types—a common pattern for handling multiple possible data structures. When processing union data, the library fails to enforce recursion depth limits that normally prevent attackers from sending deeply nested objects that exhaust memory and crash applications. An attacker can send specially crafted MessagePack data with unknown union keys that bypasses these safety checks entirely, leading to denial of service.

• CVE-2026-4870HIGH 7.5

  IBM Qiskit SDK versions 0.43.0 through 2.5.0 contain a parser vulnerability that allows remote attackers to cause the application to crash by triggering excessive recursion. An attacker can send specially crafted input that forces the parser into a recursive loop, ultimately causing a segmentation fault and denying service to legitimate users. No authentication is required, and the attack can be launched over the network.

• CVE-2026-48712HIGH 7.5

  protobufjs is a widely used JavaScript library that converts protobuf message definitions into executable code. Versions before 7.6.1 and 8.4.1 contain a flaw where the library fails to limit recursion depth when converting decoded protobuf messages to plain JavaScript objects or JSON format. An attacker can craft a malicious protobuf message with deeply nested structures (particularly using the google.protobuf.Any type) that will cause the JavaScript runtime to exhaust its call stack, crashing the application. This is a denial-of-service vulnerability affecting any service that parses untrusted protobuf input and converts it to JSON or object form.

• CVE-2026-49847HIGH 7.5

  FreeSWITCH versions prior to 1.11.1 are vulnerable to a denial-of-service attack that can be triggered by sending a specially crafted WebSocket message containing deeply nested JSON data. An attacker requires no authentication and can crash the entire FreeSWITCH process from the network, immediately terminating all active calls and sessions on the affected host. The vulnerability exploits improper recursion handling in JSON parsing, causing a stack overflow that the kernel stops before any memory corruption can be weaponized.

• CVE-2026-49941HIGH 7.5

  Net::CIDR::Set, a Perl library for managing IP address ranges, contains a flaw in how it parses IP addresses. When the library receives an improperly formatted IP address, instead of rejecting it, the code enters an infinite loop trying to process it. An attacker can exploit this by sending malformed input to applications using the vulnerable library, causing them to hang and become unresponsive. This is a denial-of-service vulnerability affecting versions up to and including 0.20.

• CVE-2026-54297HIGH 7.5

  Faraday, a popular Ruby HTTP client library, contains a denial-of-service vulnerability in its default query parameter parser. When an application accepts and processes user-supplied query strings through Faraday, an attacker can craft a deeply nested parameter structure that exhausts the Ruby interpreter's call stack, crashing the thread or worker handling that request. This affects Faraday versions 1.0.0 through 1.10.5 and 2.x through 2.14.2. The vulnerability has been patched in versions 1.10.6 and 2.14.3.

• CVE-2026-9740HIGH 7.5

  MongoDB Server contains a flaw in how it validates BSON (Binary JSON) data structures that allows anyone on the network to crash the database server without needing to log in. An attacker can send a specially crafted message that exploits recursion logic in the validation code, causing the mongod process to fail. This is a denial-of-service issue—data is not stolen or modified, but legitimate database access becomes unavailable.

• CVE-2026-46149HIGH 7.1

  A vulnerability in the Linux kernel's SCSI target subsystem allows a local attacker with low privileges to read sensitive kernel memory and potentially crash the system. The issue occurs in the configfs interface where storage path group membership information is displayed. When a storage fabric's name is unusually long, the kernel writes more data than expected to a temporary buffer, and then copies that overrun data to a user-readable sysfs file. On systems with fortify checks enabled, this causes a kernel panic; on others, it leaks kernel memory to unprivileged users.

• CVE-2025-71382MEDIUM 6.5

  MuPDF, a popular open-source PDF and EPUB rendering library, contains a denial-of-service vulnerability in its EPUB CSS processing engine. An attacker can craft a malicious EPUB file with deeply nested HTML elements and CSS styles that causes the application to recursively process CSS property inheritance without stopping, ultimately crashing any application using MuPDF to read EPUB files. The vulnerability requires user interaction (opening the file) but affects any software embedding MuPDF for document viewing.

• CVE-2026-44740MEDIUM 6.5

  Billy, a Go library that abstracts filesystem operations, contains multiple input validation flaws that can cause denial-of-service conditions. When processing untrusted repository or filesystem data, the library can panic, enter infinite loops, or consume excessive system resources due to missing safeguards like cycle detection and recursion limits. Authenticated users can trigger these conditions over the network. The issue affects versions prior to 5.9.0 and 6.0.0-alpha.1.

• CVE-2026-46557MEDIUM 6.2

  ImageMagick, a widely-used image editing and manipulation library, contains a stack overflow vulnerability in its fx (effects) operation. When processing specially crafted input, the affected code fails to validate recursion depth, allowing an attacker to exhaust the stack and crash the application or potentially execute arbitrary code. The vulnerability affects all versions before 7.1.2-23 and can be triggered locally without user interaction or special privileges.

• CVE-2026-47306MEDIUM 6.1

  Samsung's rlottie library contains a flaw that allows specially crafted animation files to trigger uncontrolled recursion. When processing oversized serialized data payloads, the library fails to properly limit recursion depth, which can exhaust system resources and crash applications that depend on it. The vulnerability requires user interaction—a user must open or process a malicious animation file—but once triggered, it reliably denies service to the affected application.

• CVE-2026-47320MEDIUM 6.1

  CVE-2026-47320 is a memory safety vulnerability in Samsung's rlottie animation library that combines two distinct weaknesses: uninitialized pointer access and uncontrolled recursion. An attacker can craft malicious animation files that trigger pointer manipulation or send oversized serialized payloads, leading to application crashes and potential data corruption. The vulnerability requires local access and user interaction to exploit—someone must open a specially crafted file. While not as critical as remote execution flaws, this defect threatens availability and integrity on systems that process untrusted animation content.

• CVE-2026-40989MEDIUM 5.7

  Spring Cloud Function versions across multiple release lines contain a flaw in the routing layer that can trigger infinite recursion during request handling. This recursion exhausts available memory, causing an out-of-memory (OOM) error that crashes the application. The vulnerability requires either physical access to the system or authenticated local access to exploit, which limits its immediate risk in cloud-native deployments but remains a concern for containerized environments or systems with weak internal network segmentation.

• CVE-2025-7005MEDIUM 5.5

  Avast Antivirus and related Gen Digital products contain a flaw that causes their scanning engine to get stuck in an infinite loop when it encounters a specially crafted Windows executable file. An attacker who tricks a user into downloading a malformed file could crash the antivirus process, leaving the system temporarily unprotected. The vulnerability affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus across Windows, macOS, and Linux platforms. Gen Digital has fixed the issue in virus definition build VPS 25031700 and later, which rolls out automatically to all affected products through a shared update channel.

• CVE-2025-7010MEDIUM 5.5

  A stack overflow flaw in the antivirus engines used by Avast, AVG, Norton, and related products can crash the scanning process when it encounters a specially crafted PDF file. The vulnerability stems from unchecked recursive calls in the PDF parsing logic, which is shared across multiple Gen Digital consumer and business antivirus products via a centralized virus definition update channel. An attacker who can deliver a malformed PDF to a user could trigger a denial-of-service condition, temporarily disabling real-time malware protection until the antivirus process restarts.

• CVE-2026-47770MEDIUM 5.5

  jq, a widely-used command-line tool for processing and querying JSON data, contains a denial-of-service vulnerability in versions before 1.8.2. When comparing two deeply nested JSON arrays using the == operator, jq crashes due to stack exhaustion. An attacker can trigger this crash by supplying specially crafted nested JSON structures, either directly via command-line input or through embedded jq usage in applications. The crash leaves no data corruption or security breach—just service unavailability. This is a local or user-interaction vulnerability, not remotely exploitable on its own, but it can disrupt any workflow or service relying on jq to process untrusted JSON.

• CVE-2026-48734MEDIUM 5.5

  ImageMagick, a widely-used open-source image manipulation tool, contains a stack overflow vulnerability when processing specially crafted MVG (Magick Vector Graphics) files. An attacker can create a malicious MVG file that, when opened by a user in ImageMagick, causes the application to crash or become unresponsive. This occurs because the software fails to properly limit recursion depth or track which parts of the file it has already processed, allowing unbounded stack consumption. The vulnerability requires user interaction—someone must explicitly open the malicious file—but no special privileges are needed.

• CVE-2026-45664MEDIUM 5.3

  ImageMagick, a widely-used tool for image processing and manipulation, has a vulnerability in its MNG (Multiple-Image Network Graphics) file handler that allows an attacker to bypass resource limits. By crafting a malicious MNG file with more images than the system's policy allows, an attacker can trigger excessive resource consumption—potentially causing performance degradation or denial of service. The vulnerability affects ImageMagick versions before 6.9.13-47 and 7.1.2-22, and has been resolved in those patch versions.

• CVE-2026-47706MEDIUM 5.3

  Strawberry GraphQL versions 0.71.0 through 0.315.6 contain a denial-of-service vulnerability in the QueryDepthLimiter extension. An attacker can craft a GraphQL query with circular fragment references that causes the validation process to enter infinite recursion, crashing the server. This affects any GraphQL API built with vulnerable Strawberry versions. The issue is resolved in version 0.315.7.

• CVE-2026-54269MEDIUM 5.3

  protobufjs is a widely-used library that converts Protocol Buffer schema definitions into JavaScript code. Versions before 8.6.0 and 7.6.3 contain a flaw where certain field or service names—particularly hasOwnProperty, $type, and rpcCall—can collide with names reserved by protobufjs's internal runtime helpers. When a schema uses these conflicting names, the library may read attacker-controlled data from the schema instead of accessing its own safety mechanisms, potentially causing the application to crash or enter infinite loops during message decoding, validation, or RPC operations.