Search results

SPARQL parser has unbounded recursion on nested groups and expressions — stack-overflow DoS on the query path

Status: Open.

#1564 In fluree/db;

· zonotope opened on Jul 29, 2026

Overlay-flake translation silently drops novelty-only subjects/strings instead of routing them to the raw-flake lane

Status: Open.

#1563 In fluree/db;

· zonotope opened on Jul 29, 2026

JSON-LD query parser has no recursion-depth guard — the remaining unguarded front-end

Status: Open.

#1562 In fluree/db;

· zonotope opened on Jul 29, 2026

JSON-LD expansion recursion is bounded only by serde_json's text-parse limit

Status: Open.

#1561 In fluree/db;

· zonotope opened on Jul 29, 2026

Datalog rules derive zero facts with no diagnostic when insert-pattern variables don't bind

Status: Open.

#1560 In fluree/db;

· zonotope opened on Jul 29, 2026

Datalog rule patterns with unbound subject+predicate trigger repeated full-graph scans

Status: Open.

#1559 In fluree/db;

· zonotope opened on Jul 29, 2026

Datalog JSON-LD rule parser silently mis-classifies bare keys, bare @type values, and JSON-LD keywords

Status: Open.

#1558 In fluree/db;

· zonotope opened on Jul 29, 2026

Datalog fixpoint does O(n²) work across iterations: per-flake Debug-format dedup keys + full overlay rebuild each round

Status: Open.

#1557 In fluree/db;

· zonotope opened on Jul 29, 2026

Datalog rule FILTERs cannot compare against an IRI — the exclusion form fails open silently

Status: Open.

#1556 In fluree/db;

· zonotope opened on Jul 29, 2026

File storage: superseded index snapshots/dictionaries are never reclaimed in practice, and POST /reindex permanently breaks the GC chain (root published with no garbage manifest)

Status: Open.

#1548 In fluree/db;

· xf-salva opened on Jul 28, 2026

Remote mount: branchless lookup key poisons ledger load with legacy index-root addresses; failed load is cached until container recycle

Status: Open.

#1540 In fluree/db;

· jakep36 opened on Jul 23, 2026

Serve graph-source artifacts (snapshots/mappings) over the storage-proxy object endpoint

Status: Open.

#1539 In fluree/db;

· aaj3f opened on Jul 23, 2026