CVE-2026-116011High· 7.5▾ TwilightCrow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.
Crow < 1.3.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2021-45105Medium· 5.9Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups
CVE-2022-50407Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - increase the memory of local variables Increase the buffer to prevent stack overflow by fuzz test
CVE-2026-24401Medium· 6.5Avahi has Uncontrolled Recursion in lookup_handle_cname function
CVE-2026-114605High· 7.5dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal (CVE-2026-114605)
CVE-2026-66282Medium· 6.0Authenticated Denial-of-Service in Zigbee Publish Billing Period
CVE-2026-110974Medium· 6.3Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json