CWE-674

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "next"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "14.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-47831"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-14T19:45:21Z",
    "nvd_published_at": "2024-10-14T18:15:05Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nThe image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption.\n\n**Not affected:**\n- The `next.config.js` file is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value.\n- The Next.js application is hosted on Vercel. \n\n### Patches\nThis issue was fully patched in Next.js `14.2.7`. We recommend that users upgrade to at least this version.\n\n### Workarounds\nEnsure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.\n\n#### Credits\nBrandon Dahler (brandondahler), AWS\nDimitrios Vlastaras",
  "id": "GHSA-g77x-44xx-532m",
  "modified": "2024-11-08T18:55:47Z",
  "published": "2024-10-14T19:45:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47831"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/commit/d11cbc9ff0b1aaefabcba9afe1e562e0b1fde65a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vercel/next.js"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Denial of Service condition in Next.js image optimization"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-43519"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-09T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.",
  "id": "GHSA-g78p-3v3v-h7wm",
  "modified": "2022-05-24T19:20:09Z",
  "published": "2022-05-24T19:20:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43519"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C7XHFYHGSZKL53VCLSJSAJ6VMFGAIXKO"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3EMGAQ5Y6GXJLY4K5DUOOEQT4MZ4J4F"
    },
    {
      "type": "WEB",
      "url": "http://lua-users.org/lists/lua-l/2021-10/msg00123.html"
    },
    {
      "type": "WEB",
      "url": "http://lua-users.org/lists/lua-l/2021-11/msg00015.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-9996"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-04-10T22:29:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_template_value_parm, demangle_integral_value, and demangle_expression.",
  "id": "GHSA-g8cr-hg2h-9wfr",
  "modified": "2022-05-13T01:53:58Z",
  "published": "2022-05-13T01:53:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9996"
    },
    {
      "type": "WEB",
      "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85304"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/103733"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-18898"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-19T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A stack exhaustion issue in the printIFDStructure function of Exiv2 0.27 allows remote attackers to cause a denial of service (DOS) via a crafted file.",
  "id": "GHSA-g97p-564p-26xp",
  "modified": "2022-05-24T19:11:50Z",
  "published": "2022-05-24T19:11:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-18898"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Exiv2/exiv2/issues/741"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/674.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-6071"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-03-24T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the compression pointer is followed without checking for recursion, leading to a denial of service. An attacker can send an mDNS message to trigger this vulnerability.",
  "id": "GHSA-g97q-39hw-52p8",
  "modified": "2022-05-24T17:12:34Z",
  "published": "2022-05-24T17:12:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6071"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202005-10"
    },
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-0994"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2020/dsa-4671"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.5.13"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.docx4j:docx4j-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "11.5.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53752"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-17T21:55:49Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\ndocx4j\u0027s `PropertyResolver` and several adjacent helpers recursively walk the OpenXML style inheritance chain (`w:basedOn`) without cycle detection. \n\nA WordprocessingML document containing a cyclic style chain (for example, Style A based on B and Style B based on A) causes unbounded recursion and a `java.lang.StackOverflowError` within the property-resolution code path.\n\nThese helpers are used by operations that require effective style resolution, including common conversion and TOC-related paths.  As a result, most server-side pipelines that accept a user-supplied docx and process it through docx4j can likely be crashed by a file containing a cyclic style reference.\n\n### Details\n\nRepresentative snippet: `PropertyResolver.fillPPrStack`\n\n```java\nprivate void fillPPrStack(String styleId, Stack\u003cPPr\u003e pPrStack) {\n    Style style = liveStyles.get(styleId);\n    ...\n    // if it is based on, recurse\n    if (style.getBasedOn() == null) {\n        log.debug(\"Style \" + styleId + \" is a root style.\");\n    } else if (style.getBasedOn().getVal() != null) {\n        String basedOnStyleName = style.getBasedOn().getVal();\n        fillPPrStack(basedOnStyleName, pPrStack);   // \u2190 unbounded recursion\n        ...\n```\n\n### Impact\nThis is a denial of service against a server-side application that processes untrusted docx files via docx4j. \n\nAn upload causes the processing thread to be terminated with `StackOverflowError` which may crash the worker thread, degrade the thread pool, or evade normal per-request CPU and heap-memory safeguards in containers and serverless functions (because the failure mode is thread-stack exhaustion rather than gradual resource consumption).\n\nThe attack depends on the host application\u0027s access controls and requires no user interaction beyond submitting the file. Detection is difficult because the file is a well-formed OOXML package containing ordinary style elements,  and passes standard antivirus and content-inspection rules.\n\nSeverity: High for server-side applications that process untrusted DOCX files using docx4j style/property resolution (unless the application catches StackOverflowError, isolates conversion in disposable worker processes, restarts workers cleanly, and the practical impact is only failure of one request). Severity may be Medium where document upload requires authentication, processing is isolated, or the failure is limited to a single request/worker.\n\n### Credits\nThanks to Koh You Liang ([@Isopach](https://github.com/Isopach)) for responsibly disclosing this issue.",
  "id": "GHSA-gc95-3vw8-vg43",
  "modified": "2026-08-17T21:55:49Z",
  "published": "2026-08-17T21:55:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/plutext/docx4j/security/advisories/GHSA-gc95-3vw8-vg43"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/plutext/docx4j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/plutext/docx4j/releases/tag/docx4j-11.5.14"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "deepmerge-ts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40345"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-17T13:32:13Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`deepmerge()` and `deepmergeInto()` can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws `RangeError: Maximum call stack size exceeded`.\n\n### Details\n\nRecord merging is implemented recursively. For each enumerable key, the library collects the values from every input object and immediately calls the same merge routine on that property.\n\nThere is no visited-object tracking, pair tracking, or cycle detection in that recursion. As a result, if two merged records both point back to themselves through the same key path, the merge logic keeps revisiting the same object pair forever.\n\nThis is reachable through the real public API:\n\n* `deepmerge(...)`\n* `deepmergeCustom(...)(...)`\n* `deepmergeInto(target, ...)`\n* `deepmergeIntoCustom(...)(target, ...)`\n\nThe issue only occurs when recursive object graphs are supplied. Plain JSON alone does not create this condition.\n\n### PoC\n\n```js\nimport { deepmerge, deepmergeInto } from \"deepmerge-ts\";\n\nconst left = {};\nleft.self = left;\n\nconst right = {};\nright.self = right;\n\ntry {\n  deepmerge(left, right);\n} catch (error) {\n  console.log(error.name, error.message);\n  // Expected: the merge should reject or safely handle recursive input without exhausting the stack.\n  // Vulnerable behavior: RangeError Maximum call stack size exceeded\n}\n\nconst target = {};\ntarget.self = target;\n\nconst source = {};\nsource.self = source;\n\ntry {\n  deepmergeInto(target, source);\n} catch (error) {\n  console.log(error.name, error.message);\n  // Expected: the merge should reject or safely handle recursive input without exhausting the stack.\n  // Vulnerable behavior: RangeError Maximum call stack size exceeded\n}\n```\n\n### Impact\n\nApplications that pass attacker-controlled recursive object graphs into these APIs can be forced into a synchronous crash path. In Node.js services, that can terminate request handling for the affected process or trigger repeated worker restarts until the malicious input is blocked.",
  "id": "GHSA-ggr8-5vv4-36mx",
  "modified": "2026-08-17T13:32:13Z",
  "published": "2026-08-17T13:32:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-ggr8-5vv4-36mx"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/RebeccaStevens/deepmerge-ts"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RebeccaStevens/deepmerge-ts/releases/tag/v8.0.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "DeepmergeTS has stack exhaustion when merging recursive object graphs"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-24302"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-12T17:15:32Z",
    "severity": "MODERATE"
  },
  "details": "Uncontrolled recursion for some TinyCBOR libraries maintained by Intel(R) before version 0.6.1 may allow an authenticated user to potentially enable escalation of privilege via local access.",
  "id": "GHSA-ggxv-cf23-46hq",
  "modified": "2025-08-12T18:31:28Z",
  "published": "2025-08-12T18:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24302"
    },
    {
      "type": "WEB",
      "url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01326.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-64219"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-24T16:16:49Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async\n\n[Why\u0026How]\ndc_process_dmub_aux_transfer_async() copies payload-\u003elength bytes into a\n16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which\nis a no-op in release builds. If a caller ever passes length \u003e 16 this\nresults in a stack buffer overflow via memcpy.\n\nAdditionally, link_index is used to dereference dc-\u003elinks[] without\nbounds checking against dc-\u003elink_count, risking an out-of-bounds access.\n\nReplace the ASSERT with a hard runtime check that returns false when\npayload-\u003elength exceeds the destination buffer size, and add a bounds\ncheck for link_index before it is used.\n\n(cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881)",
  "id": "GHSA-gjfp-5cfr-xp55",
  "modified": "2026-07-27T06:30:30Z",
  "published": "2026-07-24T18:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64219"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/16a5fa57565afb6bf37e18129921c270c93d8e2b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1c8c6e912f2945b2a3e669afca6b52174b88e86e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1ecde19bfce6535bffddad1139ff466b6d401b8e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3265f3ed373fb8048be713aadcdf702579a0e53d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6c92f6d9600efa3ef0d9e560a2b52776d9803c29"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/90c398e822ca76e40548df0c061dd4f93ea92d71"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d6590e3f766e3111dd1beaf88b9384d117acfa6b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-47320"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-04T10:16:39Z",
    "severity": "MODERATE"
  },
  "details": "Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation, Oversized Serialized Data Payloads.\n\nThis issue affects rlottie: before eae37633fda13ac05b25c6c95aacea4bc33c80a3.",
  "id": "GHSA-gjw3-x488-w5c3",
  "modified": "2026-06-04T12:30:25Z",
  "published": "2026-06-04T12:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47320"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Samsung/rlottie/pull/593"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}