Description
Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads.

This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
Published: 2026-05-19
Score: 5.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An overflow in Samsung Escargot’s handling of serialized data can lead to uncontrolled recursion, which may exhaust the stack and cause the engine to crash, resulting in a denial of service. The weakness is classified as CWE-674 uncontrolled recursion.

Affected Systems

The bug appears in Samsung Escargot at commit 590345cc6258317c5da850d846ce6baaf2afc2d3; no specific release number was supplied, so all builds containing this commit are affected.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate impact, and while the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker sending an oversized serialized payload to an Escargot‑based application, with no authentication or privilege escalation required.

Generated by OpenCVE AI on May 19, 2026 at 07:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Escargot to the fixed revision referenced in https://github.com/Samsung/escargot/pull/1565, which includes the commit 590345cc6258317c5da850d846ce6baaf2afc2d3.
  • Configure Escargot or surrounding components to restrict the size of serialized data and limit recursion depth to safe thresholds.
  • Implement runtime monitoring or add boundary checks so that any attempt to process excessively large payloads is caught before recursion escalates.

Generated by OpenCVE AI on May 19, 2026 at 07:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 19 May 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Samsung Open Source
Samsung Open Source escargot
Vendors & Products Samsung Open Source
Samsung Open Source escargot

Tue, 19 May 2026 06:30:00 +0000

Type Values Removed Values Added
Description Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
Weaknesses CWE-674
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Samsung Open Source Escargot
cve-icon MITRE

Status: PUBLISHED

Assigner: samsung.tv_appliance

Published:

Updated: 2026-05-19T04:47:46.930Z

Reserved: 2026-05-19T02:40:40.159Z

Link: CVE-2026-47309

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-05-19T07:16:29.813

Modified: 2026-05-19T07:16:29.813

Link: CVE-2026-47309

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-19T07:30:44Z

Weaknesses