CWE-674
Allowed-with-ReviewUncontrolled Recursion
Abstraction: Class · Status: Draft
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
751 vulnerabilities reference this CWE, most recent first.
GHSA-M32J-3CX3-Q692
Vulnerability from github – Published: 2022-05-24 16:57 – Updated: 2024-04-04 02:01Foxit Reader 9.6.0.25114 and earlier has two unique RecursiveCall bugs involving 3 functions exhausting available stack memory because of Uncontrolled Recursion in the V8 JavaScript engine (issue 2 of 2).
{
"affected": [],
"aliases": [
"CVE-2019-13124"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-09-30T20:15:00Z",
"severity": "HIGH"
},
"details": "Foxit Reader 9.6.0.25114 and earlier has two unique RecursiveCall bugs involving 3 functions exhausting available stack memory because of Uncontrolled Recursion in the V8 JavaScript engine (issue 2 of 2).",
"id": "GHSA-m32j-3cx3-q692",
"modified": "2024-04-04T02:01:54Z",
"published": "2022-05-24T16:57:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13124"
},
{
"type": "WEB",
"url": "https://www.foxitsoftware.com/support/security-bulletins.php"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M33J-R627-QPHR
Vulnerability from github – Published: 2025-10-30 12:31 – Updated: 2026-02-26 18:31In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix recursive locking in RPC handle list access
Since commit 305853cce3794 ("ksmbd: Fix race condition in RPC handle list access"), ksmbd_session_rpc_method() attempts to lock sess->rpc_lock.
This causes hung connections / tasks when a client attempts to open a named pipe. Using Samba's rpcclient tool:
$ rpcclient //192.168.1.254 -U user%password $ rpcclient $> srvinfo
Kernel side: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000 Workqueue: ksmbd-io handle_ksmbd_work Call trace: __schedule from schedule+0x3c/0x58 schedule from schedule_preempt_disabled+0xc/0x10 schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8 rwsem_down_read_slowpath from down_read+0x28/0x30 down_read from ksmbd_session_rpc_method+0x18/0x3c ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68 ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228 ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8 create_smb2_pipe from smb2_open+0x10c/0x27ac smb2_open from handle_ksmbd_work+0x238/0x3dc handle_ksmbd_work from process_scheduled_works+0x160/0x25c process_scheduled_works from worker_thread+0x16c/0x1e8 worker_thread from kthread+0xa8/0xb8 kthread from ret_from_fork+0x14/0x38 Exception stack(0x8529ffb0 to 0x8529fff8)
The task deadlocks because the lock is already held: ksmbd_session_rpc_open down_write(&sess->rpc_lock) ksmbd_rpc_open ksmbd_session_rpc_method down_read(&sess->rpc_lock) <-- deadlock
Adjust ksmbd_session_rpc_method() callers to take the lock when necessary.
{
"affected": [],
"aliases": [
"CVE-2025-40090"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-30T10:15:33Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix recursive locking in RPC handle list access\n\nSince commit 305853cce3794 (\"ksmbd: Fix race condition in RPC handle list\naccess\"), ksmbd_session_rpc_method() attempts to lock sess-\u003erpc_lock.\n\nThis causes hung connections / tasks when a client attempts to open\na named pipe. Using Samba\u0027s rpcclient tool:\n\n $ rpcclient //192.168.1.254 -U user%password\n $ rpcclient $\u003e srvinfo\n \u003cconnection hung here\u003e\n\nKernel side:\n \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:kworker/0:0 state:D stack:0 pid:5021 tgid:5021 ppid:2 flags:0x00200000\n Workqueue: ksmbd-io handle_ksmbd_work\n Call trace:\n __schedule from schedule+0x3c/0x58\n schedule from schedule_preempt_disabled+0xc/0x10\n schedule_preempt_disabled from rwsem_down_read_slowpath+0x1b0/0x1d8\n rwsem_down_read_slowpath from down_read+0x28/0x30\n down_read from ksmbd_session_rpc_method+0x18/0x3c\n ksmbd_session_rpc_method from ksmbd_rpc_open+0x34/0x68\n ksmbd_rpc_open from ksmbd_session_rpc_open+0x194/0x228\n ksmbd_session_rpc_open from create_smb2_pipe+0x8c/0x2c8\n create_smb2_pipe from smb2_open+0x10c/0x27ac\n smb2_open from handle_ksmbd_work+0x238/0x3dc\n handle_ksmbd_work from process_scheduled_works+0x160/0x25c\n process_scheduled_works from worker_thread+0x16c/0x1e8\n worker_thread from kthread+0xa8/0xb8\n kthread from ret_from_fork+0x14/0x38\n Exception stack(0x8529ffb0 to 0x8529fff8)\n\nThe task deadlocks because the lock is already held:\n ksmbd_session_rpc_open\n down_write(\u0026sess-\u003erpc_lock)\n ksmbd_rpc_open\n ksmbd_session_rpc_method\n down_read(\u0026sess-\u003erpc_lock) \u003c-- deadlock\n\nAdjust ksmbd_session_rpc_method() callers to take the lock when necessary.",
"id": "GHSA-m33j-r627-qphr",
"modified": "2026-02-26T18:31:34Z",
"published": "2025-10-30T12:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40090"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1891abe832cbf5a11039e088766131d0f1642d02"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3412fbd81b46b9cfae013817b61d4bbd27e09e36"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4602b8cee1481dbb896182e5cb1e8cf12910e9e7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5493571f4351f74e11db9943e98a07c56467cf7e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/88f170814fea74911ceab798a43cbd7c5599bed4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M3GJ-74X3-VC94
Vulnerability from github – Published: 2026-07-20 21:31 – Updated: 2026-08-30 21:30Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.
Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.
The guard $link < $offset prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache ($cache) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.
A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of offset / 2. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.
The vulnerability is triggered by Net::DNS::Packet->new(\$wire) i.e. any point where the library decodes a DNS message from the network.
{
"affected": [],
"aliases": [
"CVE-2026-64194"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-20T19:17:30Z",
"severity": "HIGH"
},
"details": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link \u003c $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl\u0027s default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet-\u003enew(\\$wire)` i.e. any point where the library decodes a DNS message from the network.",
"id": "GHSA-m3gj-74x3-vc94",
"modified": "2026-08-30T21:30:25Z",
"published": "2026-07-20T21:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64194"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00052.html"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes"
},
{
"type": "WEB",
"url": "https://rt.cpan.org/Ticket/Display.html?id=179946"
},
{
"type": "WEB",
"url": "https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/07/20/13"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M3JP-GXGQ-RPR9
Vulnerability from github – Published: 2026-06-03 00:30 – Updated: 2026-06-03 00:30Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested directories on a bind-mounted host folder and triggered a dentry invalidation event. This issue has been fixed in Docker Desktop 4.76.0.
{
"affected": [],
"aliases": [
"CVE-2026-8936"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-02T22:16:17Z",
"severity": "HIGH"
},
"details": "Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested directories on a bind-mounted host folder and triggered a dentry invalidation event. This issue has been fixed in Docker Desktop 4.76.0.",
"id": "GHSA-m3jp-gxgq-rpr9",
"modified": "2026-06-03T00:30:26Z",
"published": "2026-06-03T00:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8936"
},
{
"type": "WEB",
"url": "https://docs.docker.com/desktop/release-notes/#4760"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M3X9-623G-35C4
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2023-07-13 17:03NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. In RPKI, a CA can choose the RRDP repository it wishes to publish its data in. By continuously generating a new child CA that only consists of another CA using a different RRDP repository, a malicious CA can create a chain of CAs of de-facto infinite length. Routinator prior to version 0.10.2 did not contain a limit on the length of such a chain and will therefore continue to process this chain forever. As a result, the validation run will never finish, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "routinator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-43172"
],
"database_specific": {
"cwe_ids": [
"CWE-674",
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-13T17:03:13Z",
"nvd_published_at": "2021-11-09T17:15:00Z",
"severity": "HIGH"
},
"details": "NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. In RPKI, a CA can choose the RRDP repository it wishes to publish its data in. By continuously generating a new child CA that only consists of another CA using a different RRDP repository, a malicious CA can create a chain of CAs of de-facto infinite length. Routinator prior to version 0.10.2 did not contain a limit on the length of such a chain and will therefore continue to process this chain forever. As a result, the validation run will never finish, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.",
"id": "GHSA-m3x9-623g-35c4",
"modified": "2023-07-13T17:03:13Z",
"published": "2022-05-24T19:20:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43172"
},
{
"type": "WEB",
"url": "https://github.com/NLnetLabs/routinator/pull/665/commits/2f1c47378e3439cb89e084cdad6b759bbc8a72b8"
},
{
"type": "WEB",
"url": "https://www.nlnetlabs.nl/downloads/routinator/CVE-2021-43172_CVE-2021-43173_CVE-2021-43174.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Routinator infinite loop vulnerability"
}
GHSA-M3XC-H892-GGX6
Vulnerability from github – Published: 2026-05-13 15:29 – Updated: 2026-06-09 10:50Impact
Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.
These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures.
Patches
Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.
Credits
Thanks to @faran66 for finding and reporting this issue privately to the go-git project. 🙇
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-git/go-billy/v5"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.9.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-git/go-billy/v6"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.0-alpha.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44740"
],
"database_specific": {
"cwe_ids": [
"CWE-674",
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-13T15:29:47Z",
"nvd_published_at": "2026-06-01T17:17:08Z",
"severity": "MODERATE"
},
"details": "### Impact\nMultiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.\n\nThese issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures.\n\n### Patches\nUsers should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to `v5` are likely to be affected, users are recommended to upgrade to a supported `go-billy` version.\n\n### Credits\nThanks to @faran66 for finding and reporting this issue privately to the go-git project. \ud83d\ude47",
"id": "GHSA-m3xc-h892-ggx6",
"modified": "2026-06-09T10:50:07Z",
"published": "2026-05-13T15:29:47Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44740"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-git/go-billy"
},
{
"type": "WEB",
"url": "https://github.com/go-git/go-billy/releases/tag/v5.9.0"
},
{
"type": "WEB",
"url": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion"
}
GHSA-M464-HJ36-96VX
Vulnerability from github – Published: 2026-07-20 12:33 – Updated: 2026-07-20 12:33SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.
{
"affected": [],
"aliases": [
"CVE-2026-63760"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-20T12:19:46Z",
"severity": "HIGH"
},
"details": "SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.",
"id": "GHSA-m464-hj36-96vx",
"modified": "2026-07-20T12:33:11Z",
"published": "2026-07-20T12:33:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q729-696q-g9pq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63760"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-json-parser"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M5P2-59FF-782G
Vulnerability from github – Published: 2023-03-24 18:30 – Updated: 2023-03-29 15:30An issue was discovered in the Linux kernel before 5.8. lib/nlattr.c allows attackers to cause a denial of service (unbounded recursion) via a nested Netlink policy with a back reference.
{
"affected": [],
"aliases": [
"CVE-2020-36691"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T17:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in the Linux kernel before 5.8. lib/nlattr.c allows attackers to cause a denial of service (unbounded recursion) via a nested Netlink policy with a back reference.",
"id": "GHSA-m5p2-59ff-782g",
"modified": "2023-03-29T15:30:18Z",
"published": "2023-03-24T18:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36691"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/7690aa1cdf7c4565ad6b013b324c28b685505e24"
},
{
"type": "WEB",
"url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M6HM-534H-7MXM
Vulnerability from github – Published: 2025-08-04 18:30 – Updated: 2025-08-04 21:30An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the mutool clean utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the strip_outline() function enters infinite recursion
{
"affected": [],
"aliases": [
"CVE-2025-46206"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-04T18:15:34Z",
"severity": "HIGH"
},
"details": "An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion",
"id": "GHSA-m6hm-534h-7mxm",
"modified": "2025-08-04T21:30:42Z",
"published": "2025-08-04T18:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46206"
},
{
"type": "WEB",
"url": "https://bugs.ghostscript.com/show_bug.cgi?id=708521"
},
{
"type": "WEB",
"url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0ec7e4d2201bb6df217e01c17396d36297abf9ac"
},
{
"type": "WEB",
"url": "https://github.com/Landw-hub/CVE-2025-46206"
},
{
"type": "WEB",
"url": "http://artifex.com"
},
{
"type": "WEB",
"url": "http://mupdf.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M79Q-HHMW-W23C
Vulnerability from github – Published: 2026-04-30 09:30 – Updated: 2026-04-30 15:30FC-SWILS protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
{
"affected": [],
"aliases": [
"CVE-2026-5406"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-30T07:16:37Z",
"severity": "MODERATE"
},
"details": "FC-SWILS protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service",
"id": "GHSA-m79q-hhmw-w23c",
"modified": "2026-04-30T15:30:38Z",
"published": "2026-04-30T09:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5406"
},
{
"type": "WEB",
"url": "https://gitlab.com/wireshark/wireshark/-/issues/21070"
},
{
"type": "WEB",
"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21070"
},
{
"type": "WEB",
"url": "https://www.wireshark.org/security/wnpa-sec-2026-10.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
Mitigation
Increase the stack size.
CAPEC-230: Serialized Data with Nested Payloads
Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization.
CAPEC-231: Oversized Serialized Data Payloads
An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.