{"api_version":"1","generated_at":"2026-07-24T21:07:54+00:00","cve":"CVE-2026-32141","urls":{"html":"https://cve.report/CVE-2026-32141","api":"https://cve.report/api/cve/CVE-2026-32141.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-32141","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-32141"},"summary":{"title":"flatted: Unbounded recursion DoS in parse() revive phase","description":"flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-03-12 18:16:25","updated_at":"2026-07-17 13:18:13"},"problem_types":["CWE-674","CWE-770","CWE-674 CWE-674: Uncontrolled Recursion","CWE-770 Allocation of Resources Without Limits or Throttling"],"metrics":[{"version":"3.1","source":"ADP","type":"CVSS","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}},{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:40118","name":"https://access.redhat.com/errata/RHSA-2026:40118","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:5807","name":"https://access.redhat.com/errata/RHSA-2026:5807","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:36651","name":"https://access.redhat.com/errata/RHSA-2026:36651","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447083","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2447083","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:34342","name":"https://access.redhat.com/errata/RHSA-2026:34342","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32141.json","name":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32141.json","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:40945","name":"https://access.redhat.com/errata/RHSA-2026:40945","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/WebReflection/flatted/pull/88","name":"https://github.com/WebReflection/flatted/pull/88","refsource":"security-advisories@github.com","tags":["Issue Tracking","Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:9742","name":"https://access.redhat.com/errata/RHSA-2026:9742","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/security/cve/CVE-2026-32141","name":"https://access.redhat.com/security/cve/CVE-2026-32141","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:13826","name":"https://access.redhat.com/errata/RHSA-2026:13826","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2026:21772","name":"https://access.redhat.com/errata/RHSA-2026:21772","refsource":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f","name":"https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f","refsource":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Patch","Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606","name":"https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606","refsource":"security-advisories@github.com","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32141","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32141","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"WebReflection","product":"flatted","version":"affected < 3.4.0","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","version":"unaffected 1782839279 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","version":"unaffected 1782840539 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cluster Observability Operator 1.5.0","version":"unaffected 1782839996 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Developer Hub 1.8","version":"unaffected 1776784286 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Developer Hub 1.9","version":"unaffected 1777903262 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Edge Manager 1.0","version":"unaffected 1783502765 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Edge Manager 1.0","version":"unaffected 1783502438 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Edge Manager 1.1","version":"unaffected 1784194938 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Edge Manager 1.1","version":"unaffected 1784194574 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Edge Manager 1.1","version":"unaffected 1784126822 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Edge Manager 1.1","version":"unaffected 1784127736 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift AI 2.16","version":"unaffected 1774282136 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces 3.28","version":"unaffected 1779341289 * rpm","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Cryostat 4","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Logging Subsystem for Red Hat OpenShift","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Logging Subsystem for Red Hat OpenShift","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Logging Subsystem for Red Hat OpenShift","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Logging Subsystem for Red Hat OpenShift","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Logging Subsystem for Red Hat OpenShift","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Logging Subsystem for Red Hat OpenShift","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat 3scale API Management Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat 3scale API Management Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat 3scale API Management Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat 3scale API Management Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat 3scale API Management Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat 3scale API Management Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat 3scale API Management Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat 3scale API Management Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat 3scale API Management Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat AMQ Broker 7","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat build of OptaPlanner 8","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Data Grid 8","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Directory Server 11","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Directory Server 12","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Directory Server 13","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Fuse 7","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Process Automation 7","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Process Automation 7","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Process Automation 7","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Quay 3","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"Red Hat Single Sign-On 7","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"streams for Apache Kafka 2","version":"","platforms":[]},{"source":"ADP","vendor":"Red Hat","product":"streams for Apache Kafka 3","version":"","platforms":[]}],"timeline":[{"source":"ADP","time":"2026-03-12T19:01:30.987Z","lang":"en","value":"Reported to Red Hat."},{"source":"ADP","time":"2026-03-12T18:08:09.634Z","lang":"en","value":"Made public."}],"solutions":[{"source":"ADP","title":"","value":"RHSA-2026:34342: Cluster Observability Operator 1.5.0","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:9742: Red Hat Developer Hub 1.8","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:13826: Red Hat Developer Hub 1.9","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:36651: Red Hat Edge Manager 1.0","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:40945: Red Hat Edge Manager 1.1","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:40118: Red Hat Edge Manager 1.1","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:5807: Red Hat OpenShift AI 2.16","time":"","lang":"en"},{"source":"ADP","title":"","value":"RHSA-2026:21772: Red Hat OpenShift Dev Spaces 3.28","time":"","lang":"en"}],"workarounds":[{"source":"ADP","title":"","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.","time":"","lang":"en"}],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2026","cve_id":"32141","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"webreflection","cpe5":"flatted","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"node.js","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"32141","cve":"CVE-2026-32141","epss":"0.008070000","percentile":"0.527980000","score_date":"2026-07-20","updated_at":"2026-07-21 00:13:14"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-32141","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-13T16:20:15.479714Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-03-13T16:20:19.201Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["exploit"],"url":"https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f"}],"title":"CISA ADP Vulnrichment"},{"affected":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/logging-console-plugin-pf4-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782839279","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/logging-console-plugin-pf5-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782840539","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782839996","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhdh:1.8::el9"],"defaultStatus":"affected","packageName":"rhdh/rhdh-hub-rhel9","product":"Red Hat Developer Hub 1.8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1776784286","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhdh:1.9::el9"],"defaultStatus":"affected","packageName":"rhdh/rhdh-hub-rhel9","product":"Red Hat Developer Hub 1.9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1777903262","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:edge_manager:1.0::el9"],"defaultStatus":"affected","packageName":"rhem/flightctl-ui-ocp-rhel9","product":"Red Hat Edge Manager 1.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1783502765","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:edge_manager:1.0::el9"],"defaultStatus":"affected","packageName":"rhem/flightctl-ui-rhel9","product":"Red Hat Edge Manager 1.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1783502438","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:edge_manager:1.1::el10"],"defaultStatus":"affected","packageName":"rhem/flightctl-ui-ocp-rhel10","product":"Red Hat Edge Manager 1.1","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1784194938","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:edge_manager:1.1::el10"],"defaultStatus":"affected","packageName":"rhem/flightctl-ui-rhel10","product":"Red Hat Edge Manager 1.1","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1784194574","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:edge_manager:1.1::el9"],"defaultStatus":"affected","packageName":"rhem/flightctl-ui-ocp-rhel9","product":"Red Hat Edge Manager 1.1","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1784126822","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:edge_manager:1.1::el9"],"defaultStatus":"affected","packageName":"rhem/flightctl-ui-rhel9","product":"Red Hat Edge Manager 1.1","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1784127736","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.16::el8"],"defaultStatus":"affected","packageName":"rhoai/odh-dashboard-rhel8","product":"Red Hat OpenShift AI 2.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1774282136","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.28::el9"],"defaultStatus":"affected","packageName":"devspaces/dashboard-rhel9","product":"Red Hat OpenShift Dev Spaces 3.28","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1779341289","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:cryostat:4"],"defaultStatus":"unaffected","packageName":"io.cryostat-cryostat","product":"Cryostat 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:logging:5"],"defaultStatus":"affected","packageName":"openshift-logging/elasticsearch6-rhel9","product":"Logging Subsystem for Red Hat OpenShift","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:logging:5"],"defaultStatus":"affected","packageName":"openshift-logging/elasticsearch-operator-bundle","product":"Logging Subsystem for Red Hat OpenShift","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:logging:5"],"defaultStatus":"affected","packageName":"openshift-logging/elasticsearch-proxy-rhel9","product":"Logging Subsystem for Red Hat OpenShift","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:logging:5"],"defaultStatus":"affected","packageName":"openshift-logging/elasticsearch-rhel9-operator","product":"Logging Subsystem for Red Hat OpenShift","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:logging:5"],"defaultStatus":"affected","packageName":"openshift-logging/kibana6-rhel8","product":"Logging Subsystem for Red Hat OpenShift","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:logging:5"],"defaultStatus":"affected","packageName":"openshift-logging/logging-curator5-rhel9","product":"Logging Subsystem for Red Hat OpenShift","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_3scale_amp:2"],"defaultStatus":"affected","packageName":"3scale-amp20/system","product":"Red Hat 3scale API Management Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_3scale_amp:2"],"defaultStatus":"affected","packageName":"3scale-amp21/system","product":"Red Hat 3scale API Management Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_3scale_amp:2"],"defaultStatus":"affected","packageName":"3scale-amp22/system","product":"Red Hat 3scale API Management Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_3scale_amp:2"],"defaultStatus":"affected","packageName":"3scale-amp24/system","product":"Red Hat 3scale API Management Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_3scale_amp:2"],"defaultStatus":"affected","packageName":"3scale-amp25/system","product":"Red Hat 3scale API Management Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_3scale_amp:2"],"defaultStatus":"affected","packageName":"3scale-amp26/system","product":"Red Hat 3scale API Management Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_3scale_amp:2"],"defaultStatus":"affected","packageName":"3scale-amp2/system-rhel7","product":"Red Hat 3scale API Management Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_3scale_amp:2"],"defaultStatus":"unaffected","packageName":"3scale-amp2/system-rhel8","product":"Red Hat 3scale API Management Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_3scale_amp:2"],"defaultStatus":"affected","packageName":"3scale-amp2/system-rhel9","product":"Red Hat 3scale API Management Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_broker:7"],"defaultStatus":"unaffected","packageName":"org.jolokia-jolokia-parent","product":"Red Hat AMQ Broker 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-on-clouds/aoc-azure-aap-installer-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_registry:2"],"defaultStatus":"affected","packageName":"io.apicurio-apicurio-registry","product":"Red Hat build of Apicurio Registry 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:optaplanner:::el6"],"defaultStatus":"unaffected","packageName":"org.optaweb.vehiclerouting-optaweb-vehicle-routing","product":"Red Hat build of OptaPlanner 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_data_grid:8"],"defaultStatus":"affected","packageName":"org.infinispan-infinispan-console","product":"Red Hat Data Grid 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:directory_server:11"],"defaultStatus":"unaffected","packageName":"redhat-ds:11/389-ds-base","product":"Red Hat Directory Server 11","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:directory_server:12"],"defaultStatus":"unaffected","packageName":"redhat-ds:12/389-ds-base","product":"Red Hat Directory Server 12","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:directory_server:13"],"defaultStatus":"unaffected","packageName":"389-ds-base","product":"Red Hat Directory Server 13","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"grafana","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"pcs","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"grafana","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"pcs","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"],"defaultStatus":"affected","packageName":"io.syndesis-syndesis-parent","product":"Red Hat Fuse 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"defaultStatus":"unaffected","packageName":"org.jboss.hal-hal-parent","product":"Red Hat JBoss Enterprise Application Platform 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"defaultStatus":"unaffected","packageName":"org.keycloak-keycloak-parent","product":"Red Hat JBoss Enterprise Application Platform 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jbosseapxp"],"defaultStatus":"unaffected","packageName":"org.keycloak-keycloak-parent","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-argo-argoexec-rhel8","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift4/ose-console","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"defaultStatus":"unaffected","packageName":"org.kie-process-migration-service","product":"Red Hat Process Automation 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"defaultStatus":"unaffected","packageName":"org.kie.workbench-kie-wb-common","product":"Red Hat Process Automation 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"defaultStatus":"unaffected","packageName":"org.uberfire-uberfire-parent","product":"Red Hat Process Automation 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quay:3"],"defaultStatus":"unaffected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"defaultStatus":"affected","packageName":"org.keycloak-keycloak-parent","product":"Red Hat Single Sign-On 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:2"],"defaultStatus":"affected","packageName":"com.github.streamshub-console","product":"streams for Apache Kafka 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:3"],"defaultStatus":"affected","packageName":"com.github.streamshub-console","product":"streams for Apache Kafka 3","vendor":"Red Hat"}],"datePublic":"2026-03-12T18:08:09.634Z","descriptions":[{"lang":"en","value":"A denial of service flaw has been discovered in the flatted npm library. flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","description":"Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-07-17T12:04:49.201Z","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","shortName":"redhat-SADP"},"references":[{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-32141"},{"name":"RHBZ#2447083","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447083"},{"tags":["x_sadp-csaf-vex"],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32141.json"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:34342"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:9742"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:13826"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:36651"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:40945"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:40118"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:5807"},{"tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:21772"}],"solutions":[{"lang":"en","value":"RHSA-2026:34342: Cluster Observability Operator 1.5.0"},{"lang":"en","value":"RHSA-2026:9742: Red Hat Developer Hub 1.8"},{"lang":"en","value":"RHSA-2026:13826: Red Hat Developer Hub 1.9"},{"lang":"en","value":"RHSA-2026:36651: Red Hat Edge Manager 1.0"},{"lang":"en","value":"RHSA-2026:40945: Red Hat Edge Manager 1.1"},{"lang":"en","value":"RHSA-2026:40118: Red Hat Edge Manager 1.1"},{"lang":"en","value":"RHSA-2026:5807: Red Hat OpenShift AI 2.16"},{"lang":"en","value":"RHSA-2026:21772: Red Hat OpenShift Dev Spaces 3.28"}],"timeline":[{"lang":"en","time":"2026-03-12T19:01:30.987Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-03-12T18:08:09.634Z","value":"Made public."}],"title":"flatted: flatted: Unbounded recursion DoS in parse() revive phase","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}],"cna":{"affected":[{"product":"flatted","vendor":"WebReflection","versions":[{"status":"affected","version":"< 3.4.0"}]}],"descriptions":[{"lang":"en","value":"flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-674","description":"CWE-674: Uncontrolled Recursion","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-03-12T18:08:09.634Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f","tags":["x_refsource_CONFIRM"],"url":"https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f"},{"name":"https://github.com/WebReflection/flatted/pull/88","tags":["x_refsource_MISC"],"url":"https://github.com/WebReflection/flatted/pull/88"},{"name":"https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606","tags":["x_refsource_MISC"],"url":"https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606"}],"source":{"advisory":"GHSA-25h7-pfq9-p65f","discovery":"UNKNOWN"},"title":"flatted: Unbounded recursion DoS in parse() revive phase"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-32141","datePublished":"2026-03-12T18:08:09.634Z","dateReserved":"2026-03-10T22:19:36.546Z","dateUpdated":"2026-07-17T12:04:49.201Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-03-12 18:16:25","lastModifiedDate":"2026-07-17 13:18:13","problem_types":["CWE-674","CWE-770","CWE-674 CWE-674: Uncontrolled Recursion","CWE-770 Allocation of Resources Without Limits or Throttling"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-13T16:20:15.479714Z","id":"CVE-2026-32141","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:webreflection:flatted:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.4.0","matchCriteriaId":"767AEF0F-F297-47FE-8BA7-F1B7D7DFB8F0"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"32141","Ordinal":"1","Title":"flatted: Unbounded recursion DoS in parse() revive phase","CVE":"CVE-2026-32141","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"32141","Ordinal":"1","NoteData":"flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.","Type":"Description","Title":"flatted: Unbounded recursion DoS in parse() revive phase"}]}}}