UNKNOWN NVD
CVE-2026-95179
An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a
An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer.
References
- https://github.com/FFG0d/security-advisories/blob/main/advisories/CVE-2026-95179.md
- https://github.com/Samsung/rlottie/pull/603
- https://github.com/airbnb/lottie-android
This unknown severity vulnerability was published on 2026-10-15 via NVD.
vulnfeed aggregates 14529 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.