{"id":"CVE-2026-95179","title":"An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion i…","summary":"An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion i…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-674"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T19:17:49.563","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95179","references":[{"url":"https://github.com/FFG0d/security-advisories/blob/main/advisories/CVE-2026-95179.md","label":"cve@mitre.org"},{"url":"https://github.com/Samsung/rlottie/pull/603","label":"cve@mitre.org"},{"url":"https://github.com/airbnb/lottie-android","label":"cve@mitre.org"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-15T18:50:10.254387Z"},"ingestedAt":"2026-10-15T15:09:08.426Z","slug":"CVE-2026-95179","body":"## Overview\n\nAn issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":222675,"id":"CVE-2026-95179","ts":1792092514253,"field":"cvss","old":null,"new":"7.5"},{"seq":222674,"id":"CVE-2026-95179","ts":1792092514253,"field":"severity","old":"none","new":"high"}]}