GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-674

Allowed-with-Review

Uncontrolled Recursion

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

751 vulnerabilities reference this CWE, most recent first.

GHSA-7PMH-VRWW-25XX

Vulnerability from github – Published: 2024-08-30 18:43 – Updated: 2024-08-30 18:43
VLAI
Summary
freewvs's nested directory structure can interrupt scan
Details

Impact

A directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk(). This can be problematic in a case where an administrator scans the dirs of potentially untrusted users.

Patches

This has been fixed in this commit by limiting the recursion to 500 directories: https://github.com/schokokeksorg/freewvs/commit/83a6b55c0435c69f447488b791555e6078803143

This issue was discovered by Hanno Böck.

Severity
2.8 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
2.4 (Low)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "freewvs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-15101"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-30T18:43:23Z",
    "nvd_published_at": "2020-07-14T22:15:00Z",
    "severity": "LOW"
  },
  "details": "### Impact\nA directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python\u0027s recursion limit and os.walk(). This can be problematic in a case where an administrator scans the dirs of potentially untrusted users.\n\n### Patches\nThis has been fixed in this commit by limiting the recursion to 500 directories:\nhttps://github.com/schokokeksorg/freewvs/commit/83a6b55c0435c69f447488b791555e6078803143\n\nThis issue was discovered by Hanno B\u00f6ck.",
  "id": "GHSA-7pmh-vrww-25xx",
  "modified": "2024-08-30T18:43:23Z",
  "published": "2024-08-30T18:43:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/schokokeksorg/freewvs/security/advisories/GHSA-7pmh-vrww-25xx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15101"
    },
    {
      "type": "WEB",
      "url": "https://github.com/schokokeksorg/freewvs/commit/83a6b55c0435c69f447488b791555e6078803143"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/freewvs/PYSEC-2020-233.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/schokokeksorg/freewvs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "freewvs\u0027s nested directory structure can interrupt scan"
}

GHSA-7PWF-JG34-HXWP

Vulnerability from github – Published: 2022-05-20 16:58 – Updated: 2022-05-20 16:58
VLAI
Summary
Improper path handling in Kustomization files allows for denial of service
Details

The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use a specially crafted kustomization.yaml to cause Denial of Service at controller level.

In multi-tenancy deployments this can lead to multiple tenants not being able to apply their Kustomizations until the malicious kustomization.yaml is removed and the controller restarted.

Impact

Within the affected versions, users with write access to a Flux source are able to craft a malicious kustomization.yaml file which causes the controller to enter an endless loop.

Patches

This vulnerability was fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0 released on 2022-04-20. The changes introduce better handling of Kustomization files blocking references that could lead to endless loops.

Credits

The Flux engineering team found and patched this vulnerability.

For more information

If you have any questions or comments about this advisory please open an issue in the flux2 repository.

Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/fluxcd/kustomize-controller"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.16.0"
            },
            {
              "fixed": "0.24.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/fluxcd/flux2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.19.0"
            },
            {
              "fixed": "0.29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-24878"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-05-20T16:58:38Z",
    "nvd_published_at": "2022-05-06T02:15:00Z",
    "severity": "HIGH"
  },
  "details": "The kustomize-controller enables the use of Kustomize\u2019s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use a specially crafted `kustomization.yaml` to cause Denial of Service at controller level.\n\nIn multi-tenancy deployments this can lead to multiple tenants not being able to apply their Kustomizations until the malicious `kustomization.yaml` is removed and the controller restarted.\n\n### Impact\n\nWithin the affected versions, users with write access to a Flux source are able to craft a malicious `kustomization.yaml` file which causes the controller to enter an endless loop.\n\n### Patches\n\nThis vulnerability was fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0 released on 2022-04-20. The changes introduce better handling of Kustomization files blocking references that could lead to endless loops.\n\n### Credits\n\nThe Flux engineering team found and patched this vulnerability.\n\n### For more information\n\nIf you have any questions or comments about this advisory please open an issue in the [flux2 repository](http://github.com/fluxcd/flux2).",
  "id": "GHSA-7pwf-jg34-hxwp",
  "modified": "2022-05-20T16:58:38Z",
  "published": "2022-05-20T16:58:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fluxcd/flux2/security/advisories/GHSA-7pwf-jg34-hxwp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24878"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fluxcd/flux2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper path handling in Kustomization files allows for denial of service"
}

GHSA-7R4M-G29Q-QF8V

Vulnerability from github – Published: 2024-11-11 00:30 – Updated: 2024-11-19 21:31
VLAI
Details

In Faust 2.23.1, an input file with the lines "// r visualisation tCst" and "//process = +: L: abM-^Q;" and "process = route(3333333333333333333,2,1,2,3,1) : *;" leads to stack consumption.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-41737"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-10T23:15:04Z",
    "severity": "HIGH"
  },
  "details": "In Faust 2.23.1, an input file with the lines \"// r visualisation tCst\" and \"//process = +: L: abM-^Q;\" and \"process = route(3333333333333333333,2,1,2,3,1) : *;\" leads to stack consumption.",
  "id": "GHSA-7r4m-g29q-qf8v",
  "modified": "2024-11-19T21:31:30Z",
  "published": "2024-11-11T00:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41737"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grame-cncm/faust/issues/653"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grame-cncm/faust/tree/e682dbeeb7cc0ec9a1fcb6872f53433e454aa233"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7RGV-GQHR-FXG3

Vulnerability from github – Published: 2026-03-05 18:20 – Updated: 2026-03-05 20:42
VLAI
Summary
xgrammar vulnerable to DoS via multi-layer nesting
Details

Summary

The multi-level nested syntax caused a segmentation fault (core dump).

Details

A trigger stack overflow or memory exhaustion was caused by constructing a malicious grammar rule containing 30,000 layers of nested parentheses.

PoC

#!/usr/bin/env python3
"""
XGrammar - Math Expression Generation Example
"""

import xgrammar as xgr
import torch
from transformers import AutoModelForCausalLM, AutoTokenizer, AutoConfig

s = '(' * 30000 + 'a'
grammar = f"root ::= {s}"

def main():
    device = "cuda" if torch.cuda.is_available() else "cpu"
    model_name = "Qwen/Qwen2.5-0.5B-Instruct"

    # Load model
    model = AutoModelForCausalLM.from_pretrained(
        model_name,
        torch_dtype=torch.float16 if device == "cuda" else torch.float32,
        device_map=device
    )
    tokenizer = AutoTokenizer.from_pretrained(model_name)
    config = AutoConfig.from_pretrained(model_name)

    # Math expression grammar
    math_grammar = grammar

    # Setup
    tokenizer_info = xgr.TokenizerInfo.from_huggingface(
        tokenizer,
        vocab_size=config.vocab_size
    )
    compiler = xgr.GrammarCompiler(tokenizer_info)
    compiled_grammar = compiler.compile_grammar(math_grammar)

    # Generate
    prompt = "Math: "
    inputs = tokenizer(prompt, return_tensors="pt").to(device)

    xgr_processor = xgr.contrib.hf.LogitsProcessor(compiled_grammar)

    output_ids = model.generate(
        **inputs,
        max_new_tokens=50,
        logits_processor=[xgr_processor]
    )

    result = tokenizer.decode(
        output_ids[0][len(inputs.input_ids[0]):],
        skip_special_tokens=True
    )

    print(f"Generated expression: {result}")

if __name__ == "__main__":
    main()

> pip show xgrammar
Name: xgrammar
Version: 0.1.31
Summary: Efficient, Flexible and Portable Structured Generation
Home-page: 
Author: MLC Team
Author-email: 
License: Apache 2.0
Location: /home/yuelinwang/.local/lib/python3.10/site-packages
Requires: numpy, pydantic, torch, transformers, triton, typing-extensions
Required-by: 

> python3 1.py 
`torch_dtype` is deprecated! Use `dtype` instead!
Segmentation fault (core dumped)

Impact

DoS

Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.1.31"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "xgrammar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25048"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-05T18:20:08Z",
    "nvd_published_at": "2026-03-05T16:16:15Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe multi-level nested syntax caused a segmentation fault (core dump).\n\n\n### Details\n\nA trigger stack overflow or memory exhaustion was caused by constructing a malicious grammar rule containing 30,000 layers of nested parentheses.\n\n### PoC\n\n```\n#!/usr/bin/env python3\n\"\"\"\nXGrammar - Math Expression Generation Example\n\"\"\"\n\nimport xgrammar as xgr\nimport torch\nfrom transformers import AutoModelForCausalLM, AutoTokenizer, AutoConfig\n\ns = \u0027(\u0027 * 30000 + \u0027a\u0027\ngrammar = f\"root ::= {s}\"\n\ndef main():\n    device = \"cuda\" if torch.cuda.is_available() else \"cpu\"\n    model_name = \"Qwen/Qwen2.5-0.5B-Instruct\"\n    \n    # Load model\n    model = AutoModelForCausalLM.from_pretrained(\n        model_name,\n        torch_dtype=torch.float16 if device == \"cuda\" else torch.float32,\n        device_map=device\n    )\n    tokenizer = AutoTokenizer.from_pretrained(model_name)\n    config = AutoConfig.from_pretrained(model_name)\n    \n    # Math expression grammar\n    math_grammar = grammar\n    \n    # Setup\n    tokenizer_info = xgr.TokenizerInfo.from_huggingface(\n        tokenizer,\n        vocab_size=config.vocab_size\n    )\n    compiler = xgr.GrammarCompiler(tokenizer_info)\n    compiled_grammar = compiler.compile_grammar(math_grammar)\n    \n    # Generate\n    prompt = \"Math: \"\n    inputs = tokenizer(prompt, return_tensors=\"pt\").to(device)\n    \n    xgr_processor = xgr.contrib.hf.LogitsProcessor(compiled_grammar)\n    \n    output_ids = model.generate(\n        **inputs,\n        max_new_tokens=50,\n        logits_processor=[xgr_processor]\n    )\n    \n    result = tokenizer.decode(\n        output_ids[0][len(inputs.input_ids[0]):],\n        skip_special_tokens=True\n    )\n    \n    print(f\"Generated expression: {result}\")\n\nif __name__ == \"__main__\":\n    main()\n```\n\n\n\n```\n\u003e pip show xgrammar\nName: xgrammar\nVersion: 0.1.31\nSummary: Efficient, Flexible and Portable Structured Generation\nHome-page: \nAuthor: MLC Team\nAuthor-email: \nLicense: Apache 2.0\nLocation: /home/yuelinwang/.local/lib/python3.10/site-packages\nRequires: numpy, pydantic, torch, transformers, triton, typing-extensions\nRequired-by: \n\n\u003e python3 1.py \n`torch_dtype` is deprecated! Use `dtype` instead!\nSegmentation fault (core dumped)\n```\n\n\n### Impact\n\nDoS",
  "id": "GHSA-7rgv-gqhr-fxg3",
  "modified": "2026-03-05T20:42:15Z",
  "published": "2026-03-05T18:20:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-7rgv-gqhr-fxg3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25048"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mlc-ai/xgrammar"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mlc-ai/xgrammar/releases/tag/v0.1.32"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "xgrammar vulnerable to DoS via multi-layer nesting"
}

GHSA-7RVH-XQP3-PR8J

Vulnerability from github – Published: 2025-12-30 23:08 – Updated: 2025-12-30 23:08
VLAI
Summary
ImageMagick's failure to limit MVG mutual causes Stack Overflow
Details

Summary

Magick fails to check for circular references between two MVGs, leading to a stack overflow.

Details

After reading mvg1 using Magick, the following is displayed:

./magick -limit memory 2GiB -limit map 2GiB -limit disk 0 mvg:L1.mvg out.png
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3564123==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x5589549a4458 bp 0x7ffcc61f34a0 sp 0x7ffcc61efdd0 T0)
    #0 0x5589549a4458 in GetImagePixelCache MagickCore/cache.c:1726
    #1 0x5589549b02c1 in QueueAuthenticPixelCacheNexus MagickCore/cache.c:4261
    #2 0x5589549a2f24 in GetAuthenticPixelCacheNexus MagickCore/cache.c:1368
    #3 0x5589549bae98 in GetCacheViewAuthenticPixels MagickCore/cache-view.c:311
    #4 0x558954afb3a5 in DrawPolygonPrimitive._omp_fn.1 MagickCore/draw.c:5172
    #5 0x7f62dd89fa15 in GOMP_parallel (/lib/x86_64-linux-gnu/libgomp.so.1+0x14a15)
    #6 0x558954ae0f41 in DrawPolygonPrimitive MagickCore/draw.c:5156
    #7 0x558954ae5607 in DrawPrimitive MagickCore/draw.c:5875
    #8 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522
    #9 0x558954adcf67 in DrawImage MagickCore/draw.c:4561
    #10 0x55895496cedb in RenderFreetype MagickCore/annotate.c:2065
    #11 0x55895496702e in RenderType MagickCore/annotate.c:1112
    #12 0x558954963da7 in AnnotateImage MagickCore/annotate.c:544
    #13 0x558954ae4e0a in DrawPrimitive MagickCore/draw.c:5799
    #14 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522
    #15 0x558954adcf67 in DrawImage MagickCore/draw.c:4561
    #16 0x558954755a46 in ReadMVGImage coders/mvg.c:240
    #17 0x558954a15ecc in ReadImage MagickCore/constitute.c:743
    #18 0x558954ae3c76 in DrawPrimitive MagickCore/draw.c:5705
    #19 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522
    #20 0x558954adcf67 in DrawImage MagickCore/draw.c:4561
    #21 0x558954755a46 in ReadMVGImage coders/mvg.c:240
    ...

Impact

This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected.

Severity
4.0 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q16-AnyCPU"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q16-HDRI-AnyCPU"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q16-HDRI-OpenMP-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q16-HDRI-OpenMP-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q16-HDRI-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q16-HDRI-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q16-HDRI-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q16-OpenMP-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q16-OpenMP-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q16-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q16-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q8-AnyCPU"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q8-OpenMP-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q8-OpenMP-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q8-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q8-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Magick.NET-Q8-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-68950"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-30T23:08:15Z",
    "nvd_published_at": "2025-12-30T17:15:43Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nMagick fails to check for circular references between two MVGs, leading to a stack overflow.\n\n### Details\n\nAfter reading mvg1 using Magick, the following is displayed:\n```\n./magick -limit memory 2GiB -limit map 2GiB -limit disk 0 mvg:L1.mvg out.png\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==3564123==ERROR: AddressSanitizer: UNKNOWN SIGNAL on unknown address 0x000000000000 (pc 0x5589549a4458 bp 0x7ffcc61f34a0 sp 0x7ffcc61efdd0 T0)\n    #0 0x5589549a4458 in GetImagePixelCache MagickCore/cache.c:1726\n    #1 0x5589549b02c1 in QueueAuthenticPixelCacheNexus MagickCore/cache.c:4261\n    #2 0x5589549a2f24 in GetAuthenticPixelCacheNexus MagickCore/cache.c:1368\n    #3 0x5589549bae98 in GetCacheViewAuthenticPixels MagickCore/cache-view.c:311\n    #4 0x558954afb3a5 in DrawPolygonPrimitive._omp_fn.1 MagickCore/draw.c:5172\n    #5 0x7f62dd89fa15 in GOMP_parallel (/lib/x86_64-linux-gnu/libgomp.so.1+0x14a15)\n    #6 0x558954ae0f41 in DrawPolygonPrimitive MagickCore/draw.c:5156\n    #7 0x558954ae5607 in DrawPrimitive MagickCore/draw.c:5875\n    #8 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522\n    #9 0x558954adcf67 in DrawImage MagickCore/draw.c:4561\n    #10 0x55895496cedb in RenderFreetype MagickCore/annotate.c:2065\n    #11 0x55895496702e in RenderType MagickCore/annotate.c:1112\n    #12 0x558954963da7 in AnnotateImage MagickCore/annotate.c:544\n    #13 0x558954ae4e0a in DrawPrimitive MagickCore/draw.c:5799\n    #14 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522\n    #15 0x558954adcf67 in DrawImage MagickCore/draw.c:4561\n    #16 0x558954755a46 in ReadMVGImage coders/mvg.c:240\n    #17 0x558954a15ecc in ReadImage MagickCore/constitute.c:743\n    #18 0x558954ae3c76 in DrawPrimitive MagickCore/draw.c:5705\n    #19 0x558954adc72d in RenderMVGContent MagickCore/draw.c:4522\n    #20 0x558954adcf67 in DrawImage MagickCore/draw.c:4561\n    #21 0x558954755a46 in ReadMVGImage coders/mvg.c:240\n    ...\n```\n\n### Impact\nThis is a DoS vulnerability, and any situation that allows reading the mvg file will be affected.",
  "id": "GHSA-7rvh-xqp3-pr8j",
  "modified": "2025-12-30T23:08:15Z",
  "published": "2025-12-30T23:08:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7rvh-xqp3-pr8j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68950"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ImageMagick/ImageMagick/commit/204718c2211903949dcfc0df8e65ed066b008dec"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ImageMagick/ImageMagick"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ImageMagick\u0027s failure to limit MVG mutual causes Stack Overflow"
}

GHSA-7VJV-FCF5-RX4H

Vulnerability from github – Published: 2022-05-13 01:04 – Updated: 2022-05-13 01:04
VLAI
Details

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. It is a stack consumption issue in d_count_templates_scopes in cp-demangle.c after many recursive calls.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-9071"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-02-24T00:29:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. It is a stack consumption issue in d_count_templates_scopes in cp-demangle.c after many recursive calls.",
  "id": "GHSA-7vjv-fcf5-rx4h",
  "modified": "2022-05-13T01:04:40Z",
  "published": "2022-05-13T01:04:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9071"
    },
    {
      "type": "WEB",
      "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=89394"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202107-24"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20190314-0003"
    },
    {
      "type": "WEB",
      "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=24227"
    },
    {
      "type": "WEB",
      "url": "https://support.f5.com/csp/article/K02884135"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4326-1"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4336-1"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/107147"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7VXR-7VXQ-J68J

Vulnerability from github – Published: 2026-04-30 09:30 – Updated: 2026-04-30 15:30
VLAI
Details

Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters. This can eventually result in a stack overflow and panic.

Remote attackers can craft packets which cause affected systems to panic. This affects any system where pf is configured to process traffic, independent of the configured ruleset.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-7164"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-30T08:16:07Z",
    "severity": "HIGH"
  },
  "details": "Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters.  This can eventually result in a stack overflow and panic.\n\nRemote attackers can craft packets which cause affected systems to panic.  This affects any system where pf is configured to process traffic, independent of the configured ruleset.",
  "id": "GHSA-7vxr-7vxq-j68j",
  "modified": "2026-04-30T15:30:39Z",
  "published": "2026-04-30T09:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7164"
    },
    {
      "type": "WEB",
      "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:14.pf.asc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7WMM-6G5P-MV4P

Vulnerability from github – Published: 2026-07-02 21:32 – Updated: 2026-08-21 15:32
VLAI
Details

pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested PDF objects, including arrays, via ParseObjectContext() and parseArray() without enforcing a maximum nesting depth.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-38970"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-02T21:16:56Z",
    "severity": "HIGH"
  },
  "details": "pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested PDF objects, including arrays, via ParseObjectContext() and parseArray() without enforcing a maximum nesting depth.",
  "id": "GHSA-7wmm-6g5p-mv4p",
  "modified": "2026-08-21T15:32:05Z",
  "published": "2026-07-02T21:32:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-38970"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pdfcpu/pdfcpu/commit/9db810afb52b555ffcae955b32c0be3a73eb53d3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pdfcpu/pdfcpu"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pdfcpu/pdfcpu/blob/a181c19acb322d6b93a1bbda9385a864a9ad6efe/pkg/pdfcpu/model/parse.go#L325-L366"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pdfcpu/pdfcpu/blob/a181c19acb322d6b93a1bbda9385a864a9ad6efe/pkg/pdfcpu/model/parse.go#L942-L970"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pdfcpu/pdfcpu/releases/tag/v0.12.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7X29-5Q3F-F4X2

Vulnerability from github – Published: 2022-05-13 01:30 – Updated: 2022-05-13 01:30
VLAI
Details

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.

Severity
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-20796"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-02-26T02:29:00Z",
    "severity": "HIGH"
  },
  "details": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by \u0027(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+\u0027 in grep.",
  "id": "GHSA-7x29-5q3f-f4x2",
  "modified": "2022-05-13T01:30:43Z",
  "published": "2022-05-13T01:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20796"
    },
    {
      "type": "WEB",
      "url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141"
    },
    {
      "type": "WEB",
      "url": "https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20190315-0002"
    },
    {
      "type": "WEB",
      "url": "https://support.f5.com/csp/article/K26346590?utm_source=f5support\u0026amp;utm_medium=RSS"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/107160"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7XQP-2VGX-PCR5

Vulnerability from github – Published: 2026-07-28 21:31 – Updated: 2026-07-28 21:31
VLAI
Details

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.

Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-16192"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-28T20:17:23Z",
    "severity": "HIGH"
  },
  "details": "IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.",
  "id": "GHSA-7xqp-2vgx-pcr5",
  "modified": "2026-07-28T21:31:33Z",
  "published": "2026-07-28T21:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16192"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7281648"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Implementation

Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.

Mitigation
Implementation

Increase the stack size.

CAPEC-230: Serialized Data with Nested Payloads

Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization.

CAPEC-231: Oversized Serialized Data Payloads

An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.

← Back to the CWE list