Weaknesses of type CWE-674

346 results

Recursão descontrolada

Ocorre quando uma função chama a si mesma (ou a outras funções em cadeia) sem limite adequado de profundidade, consumindo toda a pilha de execução até causar travamento ou crash. O risco é permitir que dados não validados ou entrada do usuário definam a profundidade da recursão, tornando fácil um ataque de negação de serviço.

Example

Um parser XML que processa elementos aninhados chamando recursivamente a si mesmo para cada nível, sem verificar a profundidade máxima. Um atacante envia um arquivo com milhares de tags aninhadas e a aplicação entra em stack overflow.

How to mitigate

Implemente um limite máximo de profundidade de recursão (contador ou limite de pilha) e lance exceção se ultrapassado. Prefira iteração com pilha explícita quando possível, ou valide e sanitize a entrada para garantir que a complexidade da estrutura de dados não ultrapasse limites razoáveis.

CVE-2025-61766MEDIUMBucket vulnerable to infinite recursion when querying a bucket using the != operatorEPSS 0.4%CVE-2026-47180MEDIUMZeroconf: Unbounded recursion in DNS compression-pointer decoder allows LAN-local denial of serviceEPSS 0.4%CVE-2026-72686MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-91968HIGHvikunja before 2.6.0 Denial of Service via unbounded filter recursionEPSS 0.4%CVE-2026-72683MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2025-36001MEDIUMIBM Db2 Denial of ServiceEPSS 0.4%CVE-2026-89418HIGHUncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)EPSS 0.4%CVE-2025-20678MEDIUMIn ims service, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has cEPSS 0.4%CVE-2026-66393HIGHNLTK before 3.9.4 Denial of Service via JSONTaggedDecoderEPSS 0.4%CVE-2024-58264LOWThe serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.EPSS 0.4%CVE-2026-67321MEDIUMaxios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypassEPSS 0.4%CVE-2026-77465HIGHtoml-node: Uncontrolled RecursionEPSS 0.4%CVE-2026-6811MEDIUMPHP Stack ExhaustionEPSS 0.4%CVE-2025-6710HIGHPre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDBEPSS 0.4%CVE-2025-70957HIGHA Denial of Service (DoS) vulnerability was discovered in the TON Lite Server before v2024.09. The vulnerability arises from the handling ofEPSS 0.4%CVE-2025-54858HIGHBIG-IP Advanced WAF and ASM vulnerabilityEPSS 0.3%CVE-2024-58102MEDIUMAn issue was discovered in Datalust Seq before 2024.3.13545. An insecure default parsing depth limit allows stack consumption when parsing uEPSS 0.3%CVE-2026-54623HIGHdjango CMS: Plugin move endpoint allows cyclic reparenting (DoS)EPSS 0.3%CVE-2026-9740HIGHUnbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflowEPSS 0.3%CVE-2026-33508HIGHParse Server: LiveQuery subscription query depth bypassEPSS 0.3%