Weaknesses of type CWE-674

458 results

Recursão descontrolada

Ocorre quando uma função chama a si mesma (ou a outras funções em cadeia) sem limite adequado de profundidade, consumindo toda a pilha de execução até causar travamento ou crash. O risco é permitir que dados não validados ou entrada do usuário definam a profundidade da recursão, tornando fácil um ataque de negação de serviço.

Example

Um parser XML que processa elementos aninhados chamando recursivamente a si mesmo para cada nível, sem verificar a profundidade máxima. Um atacante envia um arquivo com milhares de tags aninhadas e a aplicação entra em stack overflow.

How to mitigate

Implemente um limite máximo de profundidade de recursão (contador ou limite de pilha) e lance exceção se ultrapassado. Prefira iteração com pilha explícita quando possível, ou valide e sanitize a entrada para garantir que a complexidade da estrutura de dados não ultrapasse limites razoáveis.

CVE-2026-57081HIGHNet::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded inputEPSS 0.5%CVE-2026-40007HIGHApache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowErrorEPSS 0.5%CVE-2026-54623HIGHdjango CMS: Plugin move endpoint allows cyclic reparenting (DoS)EPSS 0.5%CVE-2024-58370HIGHSurrealDB before 1.1.0 Uncontrolled Recursion Denial of ServiceEPSS 0.5%CVE-2026-63737HIGHSurrealDB before 3.1.5 Denial of Service via deep operator chainsEPSS 0.5%CVE-2026-61847MEDIUMCrass: A large number of adjacent CSS comments can trigger a SystemStackErrorEPSS 0.5%CVE-2026-110673HIGHCpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tagEPSS 0.5%CVE-2026-61846MEDIUMCrass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usageEPSS 0.5%CVE-2025-57809HIGHXGrammar affected by Denial of Service by infinite recursion grammarsEPSS 0.5%CVE-2026-92564HIGHApache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processingEPSS 0.5%CVE-2024-42369MEDIUMA room with itself as a its predecessor will freeze matrix-js-sdkEPSS 0.5%CVE-2021-41737HIGHIn Faust 2.23.1, an input file with the lines "// r visualisation tCst" and "//process = +: L: abM-^Q;" and "process = route(333333333333333EPSS 0.5%CVE-2023-2663LOWStack overflow in Xpdf 4.04 due to object loop in PDF page label treeEPSS 0.5%CVE-2026-113650MEDIUMApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)EPSS 0.5%CVE-2025-53605MEDIUMThe protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parEPSS 0.5%CVE-2026-72679MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.5%CVE-2026-56148MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.5%CVE-2026-48506HIGHMessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depthEPSS 0.5%CVE-2026-106447HIGHStableLib: Stack exhaustion denial of service via deeply nested CBOR arrays, maps, or tagsEPSS 0.5%CVE-2026-33498HIGHParse Server: Query condition depth bypass via pre-validation transform pipelineEPSS 0.5%