Common Weakness Enumeration
CWE-674
Weakness Allowed-with-ReviewUncontrolled Recursion
Abstraction: Class · Status: Draft
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Mapping guidance
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit
Modes of introduction
Implementation
The uncontrolled recursion is often due to an improper or missing conditional
Detection methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Content history
Submission: CWE Content Team
· MITRE
· 2008-04-11
· CWE Draft 9
Modification: Eric Dalci
· Cigital
· 2008-07-01
· CWE 1.0
updated Potential_Mitigations, Time_of_Introduction
Modification: CWE Content Team
· MITRE
· 2008-09-08
· CWE 1.0
updated Common_Consequences, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2009-03-10
· CWE 1.3
updated Related_Attack_Patterns
Modification: CWE Content Team
· MITRE
· 2011-03-29
· CWE 1.12
updated Relationships
Modification: CWE Content Team
· MITRE
· 2011-06-01
· CWE 1.13
updated Common_Consequences
Modification: CWE Content Team
· MITRE
· 2012-05-11
· CWE 2.2
updated Relationships
Modification: CWE Content Team
· MITRE
· 2012-10-30
· CWE 2.3
updated Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2013-02-21
· CWE 2.4
updated Relationships
Modification: CWE Content Team
· MITRE
· 2014-02-18
· CWE 2.6
updated Related_Attack_Patterns
Modification: CWE Content Team
· MITRE
· 2014-07-30
· CWE 2.8
updated Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2017-11-08
· CWE 3.0
updated Applicable_Platforms, Relationships
Modification: CWE Content Team
· MITRE
· 2019-01-03
· CWE 3.2
updated References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2019-06-20
· CWE 3.3
updated Related_Attack_Patterns, Relationships, Type
Modification: CWE Content Team
· MITRE
· 2020-02-24
· CWE 4.0
updated Related_Attack_Patterns, Relationships
Modification: CWE Content Team
· MITRE
· 2020-12-10
· CWE 4.3
updated Demonstrative_Examples, Description, Modes_of_Introduction, Observed_Examples, Potential_Mitigations, Time_of_Introduction
Modification: CWE Content Team
· MITRE
· 2021-03-15
· CWE 4.4
updated Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2022-10-13
· CWE 4.9
updated Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2023-01-31
· CWE 4.10
updated Description, Relationships
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated Detection_Factors, Relationships
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2024-02-29
· CWE 4.14
updated Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Weakness_Ordinalities
Modification: CWE Content Team
· MITRE
· 2026-04-30
· CWE 4.20
updated Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2026-10-28
· CWE 5.0
updated Common_Consequences
999 vulnerabilities reference this CWE, most recent first.
CVE-2026-124439 (GCVE-0-2026-124439)
Vulnerability from cvelistv5 – Published: 2026-11-08 13:15 – Updated: 2026-11-08 13:15
VLAI
EPSS
VEX
Title
Scriban before 7.5.3 Denial of Service via Uncatchable StackOverflowException
Summary
Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates can trigger an uncatchable StackOverflowException that terminates the host process.
Severity
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/scriban/scriban/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/scriban-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:nuget/Scriban",
"product": "scriban",
"vendor": "scriban",
"versions": [
{
"lessThan": "7.5.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.5.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:nuget/Scriban.Signed",
"product": "scriban",
"vendor": "scriban",
"versions": [
{
"lessThan": "7.5.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.5.3",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates can trigger an uncatchable StackOverflowException that terminates the host process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T13:15:33.017Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-mvmw-9jxc-7pr2)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/scriban/scriban/security/advisories/GHSA-mvmw-9jxc-7pr2"
},
{
"name": "VulnCheck Advisory: Scriban before 7.5.3 Denial of Service via Uncatchable StackOverflowException",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/scriban-before-7.5.3-denial-of-service-via-uncatchable-stackoverflowexception"
}
],
"title": "Scriban before 7.5.3 Denial of Service via Uncatchable StackOverflowException",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-124439",
"datePublished": "2026-11-08T13:15:33.017Z",
"dateReserved": "2026-11-08T02:13:42.362Z",
"dateUpdated": "2026-11-08T13:15:33.017Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124078 (GCVE-0-2026-124078)
Vulnerability from cvelistv5 – Published: 2026-11-06 20:51 – Updated: 2026-11-08 14:01 X_Open Source
VLAI
EPSS
VEX
Title
plist.js before 5.0.1 Uncontrolled Resource Consumption via Binary Parser
Summary
plist.js (npm package 'plist') before 5.0.1 contains an uncontrolled resource consumption vulnerability in the binary property-list parser (parseBinary) that allows unauthenticated attackers to crash a Node.js process by exploiting unmemoized recursive resolution of shared object references for arrays and dictionaries. Attackers can craft a small binary plist (under 200 bytes) containing chained self-referencing object indices to trigger exponential (2^N) resolution calls and memory growth, causing an unrecoverable out-of-memory crash and denial of service.
Severity
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/TooTallNate/plist.js/releases/… | patchissue-trackingrelease-notes |
| https://github.com/TooTallNate/plist.js/commit/ac… | patch |
| https://www.vulncheck.com/advisories/plist-js-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TooTallNate | plist.js |
Affected:
0 , < 5.0.1
(semver)
|
Date Public
2026-11-06 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/plist",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/plist",
"product": "plist.js",
"vendor": "TooTallNate",
"versions": [
{
"lessThan": "5.0.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muhammadyusuf Dilmurodov (agrresore)"
}
],
"datePublic": "2026-11-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "plist.js (npm package \u0027plist\u0027) before 5.0.1 contains an uncontrolled resource consumption vulnerability in the binary property-list parser (parseBinary) that allows unauthenticated attackers to crash a Node.js process by exploiting unmemoized recursive resolution of shared object references for arrays and dictionaries. Attackers can craft a small binary plist (under 200 bytes) containing chained self-referencing object indices to trigger exponential (2^N) resolution calls and memory growth, causing an unrecoverable out-of-memory crash and denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-776",
"description": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T14:01:07.381Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "plist.js plist@5.0.1 Release Notes",
"tags": [
"patch",
"issue-tracking",
"release-notes"
],
"url": "https://github.com/TooTallNate/plist.js/releases/tag/plist%405.0.1"
},
{
"tags": [
"patch"
],
"url": "https://github.com/TooTallNate/plist.js/commit/ac871e67aa0b0440da50bf40d58c6deddce9d8c1"
},
{
"name": "VulnCheck Advisory: plist.js before 5.0.1 Uncontrolled Resource Consumption via Binary Parser",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/plist-js-before-uncontrolled-resource-consumption-via-binary-parser"
}
],
"tags": [
"x_open-source"
],
"title": "plist.js before 5.0.1 Uncontrolled Resource Consumption via Binary Parser",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-124078",
"datePublished": "2026-11-06T20:51:17.545Z",
"dateReserved": "2026-11-06T20:46:36.937Z",
"dateUpdated": "2026-11-08T14:01:07.381Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123660 (GCVE-0-2026-123660)
Vulnerability from cvelistv5 – Published: 2026-11-06 08:58 – Updated: 2026-11-06 09:04
VLAI
EPSS
VEX
Title
Vulnerability-Lookup: memory amplification through webhook payload template format specifiers
Summary
In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input through a webhook notification's payload template. Each placeholder's format specifier was passed unchanged to Python's string formatting, which builds the padded result before its size can be checked. A template of a few dozen bytes, such as {"text": "{title:>999999999}"}, therefore produced a string of about 1 GB when the notification form test-rendered it on save, and repeating such fields multiplied the cost. Templates that passed the save check could also repeat placeholders such as {text} thousands of times; the notification daemon rebuilt those on every webhook delivery. Deeply nested templates raised an unhandled recursion error (HTTP 500). An attacker needs only an account, which the default configuration lets anyone create after e-mail confirmation. They could exhaust the memory of web workers or the notification daemon, causing a denial of service. Version 6.4.1 caps every number in a format specifier at 256, limits a rendered template to 1,000,000 characters both on save and at delivery, and rejects templates nested deeper than 32 levels.
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/vulnerability-lookup/vulnerabi… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vulnerability-lookup | vulnerability-lookup |
Affected:
5.5.1 , < 6.4.1
(semver)
|
GCVE extensions
8 events
Fix in same day
EU CRA: not applicable
advisory
bcp-05-x-03
- Report to fix
- same day (reported 2026-11-05 19:41 UTC → fix available 2026-11-06 08:24 UTC)
- Report to disclosure
- same day (reported 2026-11-05 19:41 UTC → public disclosure 2026-11-06 08:24 UTC)
- 2026-11-05 19:41 UTC Reported researcher Private report sent to info@circl.lu, based on a bounded local run against commit 2bb9b2f0; no request was sent to the public service.
- 2026-11-06 Validated vendor Reproduced on the save and delivery paths; review found related amplification via repeated placeholders and an unhandled recursion error.
- 2026-11-06 fix-deployed vendor 6.4.1 deployed on the CIRCL production instance.
- 2026-11-06 08:10 UTC Fix developed vendor https://github.com/vulnerability-lookup/vulnerability-lookup/commit/2076ffdae3d024649114eeb6fd185338d4bb1f40
- 2026-11-06 08:24 UTC Fix available vendor Vulnerability-Lookup 6.4.1 released. https://github.com/vulnerability-lookup/vulnerability-lookup/releases/tag/v6.4.1
- 2026-11-06 08:24 UTC Public disclosure vendor Fix and changelog entry describing the issue made public with the 6.4.1 release. https://github.com/vulnerability-lookup/vulnerability-lookup/blob/v6.4.1/CHANGELOG.md
- 2026-11-06 08:43 UTC Identifier assigned gna GCVE-1-2026-20054 assigned.
- 2026-11-06 08:43 UTC Advisory published gna https://vulnerability.circl.lu/vuln/gcve-1-2026-20054
EU Cyber Resilience Act
EU-CRA
EU
Not applicable
No exploitation observed; the Article 14 notification obligations for actively exploited vulnerabilities do not apply.
Deadlines and status are stated by the publisher. Submitting on time is not evidence of compliance, and this page does not judge it.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "vulnerability-lookup",
"vendor": "vulnerability-lookup",
"versions": [
{
"lessThan": "6.4.1",
"status": "affected",
"version": "5.5.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Matteo Panzeri (Universit\u00e0 di Pavia), GitHub @matte1782"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5"
},
{
"lang": "en",
"type": "coordinator",
"value": "C\u00e9dric Bonhomme"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input through a webhook notification\u0027s payload template. Each placeholder\u0027s format specifier was passed unchanged to Python\u0027s string formatting, which builds the padded result before its size can be checked. A template of a few dozen bytes, such as {\"text\": \"{title:\u0026gt;999999999}\"}, therefore produced a string of about 1 GB when the notification form test-rendered it on save, and repeating such fields multiplied the cost. Templates that passed the save check could also repeat placeholders such as {text} thousands of times; the notification daemon rebuilt those on every webhook delivery. Deeply nested templates raised an unhandled recursion error (HTTP 500). An attacker needs only an account, which the default configuration lets anyone create after e-mail confirmation. They could exhaust the memory of web workers or the notification daemon, causing a denial of service. Version 6.4.1 caps every number in a format specifier at 256, limits a rendered template to 1,000,000 characters both on save and at delivery, and rejects templates nested deeper than 32 levels."
}
],
"value": "In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate memory far out of proportion to their input through a webhook notification\u0027s payload template. Each placeholder\u0027s format specifier was passed unchanged to Python\u0027s string formatting, which builds the padded result before its size can be checked. A template of a few dozen bytes, such as {\"text\": \"{title:\u003e999999999}\"}, therefore produced a string of about 1 GB when the notification form test-rendered it on save, and repeating such fields multiplied the cost. Templates that passed the save check could also repeat placeholders such as {text} thousands of times; the notification daemon rebuilt those on every webhook delivery. Deeply nested templates raised an unhandled recursion error (HTTP 500). An attacker needs only an account, which the default configuration lets anyone create after e-mail confirmation. They could exhaust the memory of web workers or the notification daemon, causing a denial of service. Version 6.4.1 caps every number in a format specifier at 256, limits a rendered template to 1,000,000 characters both on save and at delivery, and rejects templates nested deeper than 32 levels."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T09:04:51.732Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/2076ffdae3d024649114eeb6fd185338d4bb1f40"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Vulnerability-Lookup: memory amplification through webhook payload template format specifiers",
"x_gcve": [
{
"extensions": {
"bcp-05-x-03": {
"x_timeline": {
"entities": [
{
"category": "discoverer",
"id": "entity-reporter",
"name": "Matteo Panzeri",
"references": [
"https://github.com/matte1782"
]
},
{
"category": "vendor",
"description": "Maintainer of Vulnerability-Lookup and operator of the vulnerability.circl.lu instance.",
"id": "entity-circl",
"name": "CIRCL",
"references": [
"https://github.com/vulnerability-lookup/vulnerability-lookup"
]
}
],
"events": [
{
"actor": "researcher",
"actorRefs": [
"entity-reporter"
],
"description": "Private report sent to info@circl.lu, based on a bounded local run against commit 2bb9b2f0; no request was sent to the public service.",
"id": "evt-reported",
"recipientRefs": [
"entity-circl"
],
"timestamp": "2026-11-05T19:41:52Z",
"type": "reported"
},
{
"actor": "vendor",
"actorRefs": [
"entity-circl"
],
"description": "Reproduced on the save and delivery paths; review found related amplification via repeated placeholders and an unhandled recursion error.",
"id": "evt-validated",
"referencedEvents": [
"evt-reported"
],
"timestamp": "2026-11-06",
"type": "validated"
},
{
"actor": "vendor",
"actorRefs": [
"entity-circl"
],
"id": "evt-fix-developed",
"referencedEvents": [
"evt-validated"
],
"references": [
"https://github.com/vulnerability-lookup/vulnerability-lookup/commit/2076ffdae3d024649114eeb6fd185338d4bb1f40"
],
"timestamp": "2026-11-06T08:10:26Z",
"type": "fix-developed"
},
{
"actor": "vendor",
"actorRefs": [
"entity-circl"
],
"description": "Vulnerability-Lookup 6.4.1 released.",
"id": "evt-fix-available",
"referencedEvents": [
"evt-fix-developed"
],
"references": [
"https://github.com/vulnerability-lookup/vulnerability-lookup/releases/tag/v6.4.1"
],
"timestamp": "2026-11-06T08:24:38Z",
"type": "fix-available"
},
{
"actor": "vendor",
"actorRefs": [
"entity-circl"
],
"description": "Fix and changelog entry describing the issue made public with the 6.4.1 release.",
"id": "evt-public-disclosure",
"references": [
"https://github.com/vulnerability-lookup/vulnerability-lookup/blob/v6.4.1/CHANGELOG.md"
],
"timestamp": "2026-11-06T08:24:38Z",
"type": "public-disclosure"
},
{
"actor": "vendor",
"actorRefs": [
"entity-circl"
],
"description": "6.4.1 deployed on the CIRCL production instance.",
"id": "evt-fix-deployed",
"referencedEvents": [
"evt-fix-available"
],
"timestamp": "2026-11-06",
"type": "fix-deployed"
},
{
"actor": "gna",
"actorRefs": [
"entity-circl"
],
"description": "GCVE-1-2026-20054 assigned.",
"id": "evt-identifier-assigned",
"timestamp": "2026-11-06T08:43:51Z",
"type": "identifier-assigned"
},
{
"actor": "gna",
"actorRefs": [
"entity-circl"
],
"id": "evt-advisory-published",
"referencedEvents": [
"evt-identifier-assigned"
],
"references": [
"https://vulnerability.circl.lu/vuln/gcve-1-2026-20054"
],
"timestamp": "2026-11-06T08:43:51Z",
"type": "advisory-published"
}
],
"regulatory": [
{
"assessment": "not-applicable",
"framework": "EU-CRA",
"jurisdiction": "EU",
"notes": "No exploitation observed; the Article 14 notification obligations for actively exploited vulnerabilities do not apply."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "gcve-1-2026-20054"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-123660",
"datePublished": "2026-11-06T08:58:24.857Z",
"dateReserved": "2026-11-06T08:57:03.368Z",
"dateUpdated": "2026-11-06T09:04:51.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121423 (GCVE-0-2026-121423)
Vulnerability from cvelistv5 – Published: 2026-11-03 14:28 – Updated: 2026-11-03 14:28
VLAI
EPSS
VEX
Title
SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization
Summary
SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.
Severity
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/surrealdb/surrealdb/security/a… | vendor-advisory |
| https://www.vulncheck.com/advisories/surrealdb-be… | third-party-advisory |
Impacted products
Date Public
2026-10-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/surrealdb",
"product": "surrealdb",
"vendor": "surrealdb",
"versions": [
{
"lessThan": "3.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.3.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "manus-use"
}
],
"datePublic": "2026-10-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T14:28:19.376Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-rpmq-gq3f-h6jg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rpmq-gq3f-h6jg"
},
{
"name": "VulnCheck Advisory: SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-dos-via-unbounded-recursion-in-val-value-serialization"
}
],
"title": "SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121423",
"datePublished": "2026-11-03T14:28:19.376Z",
"dateReserved": "2026-11-03T12:29:41.359Z",
"dateUpdated": "2026-11-03T14:28:19.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120135 (GCVE-0-2026-120135)
Vulnerability from cvelistv5 – Published: 2026-10-31 20:33 – Updated: 2026-11-06 13:45
VLAI
EPSS
VEX
Title
Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default
Summary
Uncontrolled Recursion vulnerability in Apache Thrift Java bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 13:45 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/7v3jhgwfbmhx42424… | vendor-advisory |
| https://lists.apache.org/thread/2zzkm3mfhfg79ohjo… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/10/31/2 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Thrift |
Affected:
0 , < 0.24.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-31T21:08:29.726Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/31/2"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120135",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T13:45:32.950652Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T13:45:42.878Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.thrift:libthrift",
"packageURL": "pkg:maven/org.apache.thrift/libthrift",
"product": "Apache Thrift",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.24.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao \u2013 yubao@paypal.com, who works for paypal.com"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUncontrolled Recursion vulnerability in Apache Thrift Java bindings.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Thrift: before 0.24.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.24.0, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Uncontrolled Recursion vulnerability in Apache Thrift Java bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.24.0.\n\n\n\nUsers are recommended to upgrade to version 0.24.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T20:33:00.088Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/2zzkm3mfhfg79ohjo37pg1gms5nto588"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-120135",
"datePublished": "2026-10-31T20:33:00.088Z",
"dateReserved": "2026-10-30T22:21:45.167Z",
"dateUpdated": "2026-11-06T13:45:42.878Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119762 (GCVE-0-2026-119762)
Vulnerability from cvelistv5 – Published: 2026-10-30 17:19 – Updated: 2026-10-30 18:35
VLAI
EPSS
VEX
Title
Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests
Summary
Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 18:27 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.axigen.com/kb/show/412 | vendor-advisory |
| https://www.axigen.com/updates/axigen-10.6.40 | release-notes |
| https://www.axigen.com/updates/axigen-10.7.2 | release-notes |
| https://www.vulncheck.com/advisories/axigen-mail-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Axigen | Axigen Mail Server |
Affected:
10.0.0 , < 10.5.69
(semver)
Affected: 10.6.0 , < 10.6.40 (semver) Affected: 10.7.0 , < 10.7.2 (semver) cpe:2.3:a:axigen:axigen_mail_server:*:*:*:*:*:*:*:* cpe:2.3:a:axigen:axigen_mail_server:*:*:*:*:*:*:*:* cpe:2.3:a:axigen:axigen_mail_server:*:*:*:*:*:*:*:* |
Date Public
2026-10-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119762",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T18:27:26.510638Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T18:35:08.753Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Axigen Mail Server",
"vendor": "Axigen",
"versions": [
{
"lessThan": "10.5.69",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
},
{
"lessThan": "10.6.40",
"status": "affected",
"version": "10.6.0",
"versionType": "semver"
},
{
"lessThan": "10.7.2",
"status": "affected",
"version": "10.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:axigen:axigen_mail_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.5.69",
"versionStartIncluding": "10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:axigen:axigen_mail_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.6.40",
"versionStartIncluding": "10.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:axigen:axigen_mail_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.7.2",
"versionStartIncluding": "10.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dmitri Kaslov \u0026 rootkiTED"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Cristian Draghici and Gabriel Cotruta of Axigen Security Team"
}
],
"datePublic": "2026-10-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:19:54.568Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.axigen.com/kb/show/412"
},
{
"tags": [
"release-notes"
],
"url": "https://www.axigen.com/updates/axigen-10.6.40"
},
{
"tags": [
"release-notes"
],
"url": "https://www.axigen.com/updates/axigen-10.7.2"
},
{
"name": "VulnCheck Advisory: Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/axigen-mail-server-before-10.5.69-10.6.40-and-10.7.2-unauthenticated-dos-via-nested-requests"
}
],
"title": "Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119762",
"datePublished": "2026-10-30T17:19:54.568Z",
"dateReserved": "2026-10-30T15:35:12.805Z",
"dateUpdated": "2026-10-30T18:35:08.753Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119591 (GCVE-0-2026-119591)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-11-04 22:23
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
Summary
SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 22:23 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-10-04T05:34:47Z | issue-tracking |
| https://sqlite.org/src/info/ab621a3e11ee4acc | patch |
| https://github.com/sqlite/sqlite/commit/eff50a067… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-values-union | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119591",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T22:23:12.354827Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T22:23:31.927Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://sqlite.org/bugs/info/2026-10-04T05:34:47Z"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/sqlite/sqlite",
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ke Han"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "D. Richard Hipp"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:15.714Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-10-04T05:34:47Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/ab621a3e11ee4acc"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L7199"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-values-union"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-countofviewoptimization-in-values-clause"
}
],
"title": "SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119591",
"datePublished": "2026-10-30T11:31:15.714Z",
"dateReserved": "2026-10-30T11:20:35.123Z",
"dateUpdated": "2026-11-04T22:23:31.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119542 (GCVE-0-2026-119542)
Vulnerability from cvelistv5 – Published: 2026-10-30 13:54 – Updated: 2026-10-30 15:53
VLAI
EPSS
VEX
Title
Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror
Summary
A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially affecting availability.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-119542 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2563902 | issue-trackingx_refsource_REDHAT |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 |
cpe:/a:redhat:camel_quarkus:3
|
|
| Red Hat | Red Hat Data Grid 8 |
cpe:/a:redhat:jboss_data_grid:8
|
|
| Red Hat | Red Hat Fuse 7 |
cpe:/a:redhat:jboss_fuse:7
|
|
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 |
cpe:/a:redhat:jboss_enterprise_application_platform:8
|
|
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack |
cpe:/a:redhat:jbosseapxp
|
Date Public
2026-10-30 10:22
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119542",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:17.701033Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:53:22.097Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:camel_quarkus:3"
],
"defaultStatus": "affected",
"packageName": "infinispan-query",
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "affected",
"packageName": "infinispan-query",
"product": "Red Hat Data Grid 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "unknown",
"packageName": "infinispan-query",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
],
"defaultStatus": "affected",
"packageName": "infinispan-query",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "affected",
"packageName": "infinispan-query",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank \u5218\u6625\u71d5 (Liu Chunyan) (Fudan University) for reporting this issue."
}
],
"datePublic": "2026-10-30T10:22:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially affecting availability."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:54:23.591Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-119542"
},
{
"name": "RHBZ#2563902",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563902"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-16T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-30T10:22:00.000Z",
"value": "Made public."
}
],
"title": "Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror",
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-674: Uncontrolled Recursion"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-119542",
"datePublished": "2026-10-30T13:54:23.591Z",
"dateReserved": "2026-10-30T10:22:31.998Z",
"dateUpdated": "2026-10-30T15:53:22.097Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119376 (GCVE-0-2026-119376)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-11-04 02:07
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
Summary
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 02:06 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-10-04T04:50:56Z | issue-tracking |
| https://sqlite.org/src/info/252c0b7bf5a727d2 | patch |
| https://github.com/sqlite/sqlite/commit/d54522a5b… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-collate-depth | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119376",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T02:06:58.294941Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T02:07:18.766Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://sqlite.org/bugs/info/2026-10-04T04:50:56Z"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ke Han"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "D. Richard Hipp"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:41.213Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-10-04T04:50:56Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/252c0b7bf5a727d2"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-collate-depth"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain"
}
],
"title": "SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119376",
"datePublished": "2026-10-30T11:30:41.213Z",
"dateReserved": "2026-10-30T00:57:05.506Z",
"dateUpdated": "2026-11-04T02:07:18.766Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119371 (GCVE-0-2026-119371)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:51
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()
Summary
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:50 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-10-04T04:58:58Z | issue-tracking |
| https://sqlite.org/src/info/f54730871303e655 | patch |
| https://github.com/sqlite/sqlite/commit/e6ff280c8… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-cte-nest | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119371",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:50:50.830999Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:51:05.359Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ke Han"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "D. Richard Hipp"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:37.740Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-10-04T04:58:58Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/f54730871303e655"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L5754"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-cte-nest"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-cte-chain-in-selectexpander"
}
],
"title": "SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119371",
"datePublished": "2026-10-30T11:30:37.740Z",
"dateReserved": "2026-10-30T00:39:31.960Z",
"dateUpdated": "2026-10-30T15:51:05.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
Mitigation
Implementation
Increase the stack size.
CAPEC-230: Serialized Data with Nested Payloads
Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization.
CAPEC-231: Oversized Serialized Data Payloads
An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.