What is GHSA-qcq9-5r29-gg49?

GHSA-qcq9-5r29-gg49 is a security advisory published by GitHub Security Advisories with High severity. An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a...

Which CVE IDs does GHSA-qcq9-5r29-gg49 cover?

GHSA-qcq9-5r29-gg49 covers the following CVE IDs: CVE-2026-95179. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qcq9-5r29-gg49?

GHSA-qcq9-5r29-gg49 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-qcq9-5r29-gg49HighCVSS 7.5

An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a...

Vendor

GitHub Security Advisories

Published

October 15, 2026

Last Modified

October 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-95179 →

📋 Description

An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-95179
https://github.com/Samsung/rlottie/pull/603
https://github.com/FFG0d/security-advisories/blob/main/advisories/CVE-2026-95179.md
https://github.com/airbnb/lottie-android
https://github.com/advisories/GHSA-qcq9-5r29-gg49