{"id":"CVE-2026-82604","state":"PUBLISHED","title":"BareBones BBEdit Java Language recursion","description":"A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontrolled recursion. Remote exploitation of the attack is possible. Upgrading to version 16.0 is recommended to address this issue. You should upgrade the affected component.","publishedAt":"2026-08-31T02:00:13.384Z","updatedAt":"2026-08-31T16:10:48.833Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X","source":"VulDB"},"assigner":"VulDB","products":["BareBones BBEdit"],"affected":[{"vendor":"BareBones","product":"BBEdit","versions":[{"version":"15.5.0","status":"affected"},{"version":"15.5.1","status":"affected"},{"version":"15.5.2","status":"affected"},{"version":"15.5.3","status":"affected"},{"version":"15.5.4","status":"affected"},{"version":"15.5.5","status":"affected"},{"version":"16.0","status":"unaffected"}],"cpes":["cpe:2.3:a:barebones:bbedit:*:*:*:*:*:*:*:*"],"modules":["Java Language Module"]}],"references":["https://vuldb.com/vuln/397106","https://vuldb.com/vuln/397106/cti","https://vuldb.com/cve/CVE-2026-82604","https://vuldb.com/submit/892839","https://ciphersecuritylabs.com/research/articles/fuzzing-bbedit-language-modules-stack-exhaustion-and-infinite-loop-dos-bugs","https://www.barebones.com/support/bbedit/notes-16.0.html","https://www.barebones.com/store/bbedit_upgrades.html"],"weaknesses":["CWE-674","CWE-404"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/82xxx/CVE-2026-82604.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-82604","state":"PUBLISHED","datePublished":"2026-08-31T02:00:13.384Z","dateUpdated":"2026-08-31T16:10:48.833Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-08-30T07:14:40.141Z"},"containers":{"cna":{"title":"BareBones BBEdit Java Language recursion","descriptions":[{"lang":"en","value":"A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontrolled recursion. Remote exploitation of the attack is possible. Upgrading to version 16.0 is recommended to address this issue. You should upgrade the affected component."}],"affected":[{"vendor":"BareBones","product":"BBEdit","versions":[{"version":"15.5.0","status":"affected"},{"version":"15.5.1","status":"affected"},{"version":"15.5.2","status":"affected"},{"version":"15.5.3","status":"affected"},{"version":"15.5.4","status":"affected"},{"version":"15.5.5","status":"affected"},{"version":"16.0","status":"unaffected"}],"cpes":["cpe:2.3:a:barebones:bbedit:*:*:*:*:*:*:*:*"],"modules":["Java Language Module"]}],"references":[{"url":"https://vuldb.com/vuln/397106","name":"VDB-397106 | BareBones BBEdit Java Language recursion","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/397106/cti","name":"VDB-397106 | CTI Indicators (IOB, IOC, TTP)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82604","name":"CVE-2026-82604 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/892839","name":"Submit #892839 | BareBones BBEdit 15.5.5 Denial of Service","tags":["third-party-advisory"]},{"url":"https://ciphersecuritylabs.com/research/articles/fuzzing-bbedit-language-modules-stack-exhaustion-and-infinite-loop-dos-bugs","tags":["related"]},{"url":"https://www.barebones.com/support/bbedit/notes-16.0.html","tags":["related"]},{"url":"https://www.barebones.com/store/bbedit_upgrades.html","tags":["patch"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-674","type":"CWE","lang":"en","description":"Uncontrolled Recursion"}]},{"descriptions":[{"cweId":"CWE-404","type":"CWE","lang":"en","description":"Denial of Service"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-08-31T02:00:13.384Z"},"timeline":[{"time":"2026-08-30T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-08-30T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-08-30T09:19:51.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"ciphersecuritylabs (VulDB User)","type":"reporter"}],"x_generator":["VulDB PVTS v202608"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-31T16:10:35.917124Z","id":"CVE-2026-82604","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-31T16:10:48.833Z"}}]}}}