{"affected":[{"product":"bacnet-stack","source":"CNA: GitHub_M","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.5.1"}]}],"cveId":"CVE-2026-49341","cwes":["CWE-400","CWE-674"],"description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, there is a remotely reachable denial-of-service vulnerability in bacnet-stack affecting the default demo server built from the unmodified apps/server/main.c. This issue has been patched in version 1.5.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794585233720,"publishedAt":1794585233720,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-7r8r-2rj2-5wvr"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/bacnet-stack/bacnet-stack/pull/1347"}],"remediation":[],"revision":"eebe956a0833c154a9b311a5ab31918ee8c4a57a1b9c16e09bea866662b49344","sources":[{"modifiedAt":1794585233720,"name":"CNA: GitHub_M","retrievedAt":1794586282902,"url":"https://www.cve.org/CVERecord?id=CVE-2026-49341"}],"ssvc":null,"status":"published","title":"BACnet Stack: Uncontrolled recursion in Timer object writeback path leads to remote server stack overflow","updatedAt":1794586282902}