https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:43:37 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0281 certfr-2026-avi-0281 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0281 https://cve.radiocsirt.org/vuln/euvd-2026-265137 EUVD-2026-265137 https://cve.radiocsirt.org/vuln/euvd-2026-265137 https://cve.radiocsirt.org/vuln/fkie_cve-2025-14874 <p>A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.</p> <p>A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-14874 https://cve.radiocsirt.org/vuln/ghsa-rcmh-qjqh-p98v <p><strong>Affected:</strong> npm: nodemailer, Maven: org.webjars.npm:nodemailer</p> <p>### Summary A DoS can occur that immediately halts the system due to the use of an unsafe function.</p> <p>### Details According to **RFC 5322**, nested group structures (a group inside another group) are not allowed. Therefore, in lib/addressparser/index.js, the email address parser performs flattening when nested groups appear, since such input is likely to be abnormal. (If the address is valid, it is added as-is.) In other words, the parser flattens all nested groups and inserts them into the final group list. However, the code implemented for this flattening process can be exploited by malicious input and triggers DoS</p> <p>RFC 5322 uses a colon (:) to define a group, and commas (,) are used to separate members within a group. At the following location in lib/addressparser/index.js:</p> <p>https://github.com/nodemailer/nodemailer/blob/master/lib/addressparser/index.js#L90</p> <p>there is code that performs this flattening. The issue occurs when the email address parser attempts to process the following kind of malicious address header:</p> <p>```g0: g1: g2: g3: ... gN: victim@example.com;```</p> <p>Because no recursion depth limit is enforced, the parser repeatedly invokes itself in the pattern `addressparser → _handleAddress → addressparser → ...` for each nested group. As a result, when an attacker sends a header containing many colons, Nodemailer enters infinite recursion, eventually throwing Maximum call stack size exceeded and causing the process to terminate immediately. Due to the structure of this…</p> <p><strong>Affected:</strong> npm: nodemailer, Maven: org.webjars.npm:nodemailer</p> <p>### Summary A DoS can occur that immediately halts the system due to the use of an unsafe function.</p> <p>### Details According to **RFC 5322**, nested group structures (a group inside another group) are not allowed. Therefore, in lib/addressparser/index.js, the email address parser performs flattening when nested groups appear, since such input is likely to be abnormal. (If the address is valid, it is added as-is.) In other words, the parser flattens all nested groups and inserts them into the final group list. However, the code implemented for this flattening process can be exploited by malicious input and triggers DoS</p> <p>RFC 5322 uses a colon (:) to define a group, and commas (,) are used to separate members within a group. At the following location in lib/addressparser/index.js:</p> <p>https://github.com/nodemailer/nodemailer/blob/master/lib/addressparser/index.js#L90</p> <p>there is code that performs this flattening. The issue occurs when the email address parser attempts to process the following kind of malicious address header:</p> <p>```g0: g1: g2: g3: ... gN: victim@example.com;```</p> <p>Because no recursion depth limit is enforced, the parser repeatedly invokes itself in the pattern `addressparser → _handleAddress → addressparser → ...` for each nested group. As a result, when an attacker sends a header containing many colons, Nodemailer enters infinite recursion, eventually throwing Maximum call stack size exceeded and causing the process to terminate immediately. Due to the structure of this…</p> https://cve.radiocsirt.org/vuln/ghsa-rcmh-qjqh-p98v https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-14874 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-nodemailer, Ubuntu:22.04:LTS: node-nodemailer, Ubuntu:24.04:LTS: node-nodemailer, Ubuntu:25.10: node-nodemailer, Ubuntu:26.04:LTS: node-nodemailer</p> <p>A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-nodemailer, Ubuntu:22.04:LTS: node-nodemailer, Ubuntu:24.04:LTS: node-nodemailer, Ubuntu:25.10: node-nodemailer, Ubuntu:26.04:LTS: node-nodemailer</p> <p>A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-14874 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0759 <p>Ein Angreifer kann mehrere Schwachstellen in IBM Planning Analytics ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in IBM Planning Analytics ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0759