Weaknesses of type CWE-674

346 results

Recursão descontrolada

Ocorre quando uma função chama a si mesma (ou a outras funções em cadeia) sem limite adequado de profundidade, consumindo toda a pilha de execução até causar travamento ou crash. O risco é permitir que dados não validados ou entrada do usuário definam a profundidade da recursão, tornando fácil um ataque de negação de serviço.

Example

Um parser XML que processa elementos aninhados chamando recursivamente a si mesmo para cada nível, sem verificar a profundidade máxima. Um atacante envia um arquivo com milhares de tags aninhadas e a aplicação entra em stack overflow.

How to mitigate

Implemente um limite máximo de profundidade de recursão (contador ou limite de pilha) e lance exceção se ultrapassado. Prefira iteração com pilha explícita quando possível, ou valide e sanitize a entrada para garantir que a complexidade da estrutura de dados não ultrapasse limites razoáveis.

CVE-2026-38752LOWA stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) viaEPSS 0.3%CVE-2026-38755LOWA heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplEPSS 0.3%CVE-2026-41680HIGHMarked: OOM Denial of Service via Infinite Recursion in marked TokenizerEPSS 0.3%CVE-2025-5472MEDIUMDenial of Service via Uncontrolled Recursive JSON Parsing in JSONReader in run-llama/llama_indexEPSS 0.3%CVE-2026-84851HIGHUncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6EPSS 0.3%CVE-2026-62296HIGHHAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of serviceEPSS 0.3%CVE-2026-74787HIGHScriban before 7.0.0 Uncontrolled Recursion via object.to_jsonEPSS 0.3%CVE-2026-62295HIGHHAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of serviceEPSS 0.3%CVE-2026-90472MEDIUMmsgpack-java through 0.9.12 Stack Overflow via Nested ArraysEPSS 0.3%CVE-2026-52132HIGHllama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_allEPSS 0.3%CVE-2026-72679MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.3%CVE-2026-82604MEDIUMBareBones BBEdit Java Language recursionEPSS 0.3%CVE-2026-40879HIGHNest: DoS via Recursive handleData in JsonSocket (TCP Transport)EPSS 0.3%CVE-2026-49941HIGHNet::CIDR::Set versions through 0.20 for Perl did not validate IP addressesEPSS 0.3%CVE-2026-39376HIGHFastFeedParser has an infinite redirect loop DoS via meta-refresh chainEPSS 0.3%CVE-2026-9358MEDIUMpostcss-selector-parser AST Serialization container.js toString recursionEPSS 0.3%CVE-2026-59156MEDIUMOpenImageIO: Unbounded recursion in FITS header parser leads to stack overflowEPSS 0.3%CVE-2026-73209MEDIUMAn attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. TheEPSS 0.3%CVE-2025-50420MEDIUMAn issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted EPSS 0.3%CVE-2026-74795HIGHScriban before 6.6.0 Denial of Service via Uncontrolled RecursionEPSS 0.3%