Adobe LiveCycle Data Services 3.1 and earlier LiveCycle 9.0.0.2 and earlier and BlazeDS 4.0.1 and earlier do not properly handle object graphs which allows attackers to cause a denial of service via unspecified vectors related to a \complex object graph vulnerability.\