CVE-2020-8285
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
CVSS
7.5
Alta
EPSS
9.8%
p96
KEV
—
Exploit Today
29
0-100
Publicado: 14 de dez. de 2020 · Última mod.: 14 de out. de 2026 · CWE-674 · CWE-787
9.8%EPSS · 30 dias9.8%
2026-10-142026-11-11
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
- seclists.orghttp://seclists.org/fulldisclosure/2021/Apr/51
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- curl.sehttps://curl.se/docs/CVE-2020-8285.html
- github.comhttps://github.com/curl/curl/issues/6255
- hackerone.comhttps://hackerone.com/reports/1045844
- lists.apache.orghttps://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
- security.gentoo.orghttps://security.gentoo.org/glsa/202012-14
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20210122-0007/
- support.apple.comhttps://support.apple.com/kb/HT212325
- support.apple.comhttps://support.apple.com/kb/HT212326
- support.apple.comhttps://support.apple.com/kb/HT212327
- www.debian.orghttps://www.debian.org/security/2021/dsa-4881
- www.oracle.comhttps://www.oracle.com//security-alerts/cpujul2021.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuApr2021.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2022.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2022.html
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1061548.6 ALT—
———In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.1hCVE-2026-1270307.5 ALT—
———A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS).2hCVE-2026-1270297.5 ALT—
———A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS).2hCVE-2026-1261935.3 MÉD—
———Soup Sieve is a CSS selector library for Beautiful Soup. From 0.4 until 3.0, deeply nested CSS pseudo-class selectors can cause recursive parsing to exceed Python’s recursion limit and raise RecursionError . Applications accepting untrusted selectors may experience failure of the affected request or task if the exception is not handled. The demonstrated behavior is recoverable and does not establish an interpreter crash or persistent service-wide denial of service. This vulnerability is fixed in version 3.0.2hCVE-2026-97845——
———An uncontrolled recursion vulnerability has been discovered in the Qt QXmlSimpleReader XML parsing functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt XML module (Qt 5).5hCVE-2026-1144673.3 BAI—
———Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures5h