Weaknesses of type CWE-674

458 results

Recursão descontrolada

Ocorre quando uma função chama a si mesma (ou a outras funções em cadeia) sem limite adequado de profundidade, consumindo toda a pilha de execução até causar travamento ou crash. O risco é permitir que dados não validados ou entrada do usuário definam a profundidade da recursão, tornando fácil um ataque de negação de serviço.

Example

Um parser XML que processa elementos aninhados chamando recursivamente a si mesmo para cada nível, sem verificar a profundidade máxima. Um atacante envia um arquivo com milhares de tags aninhadas e a aplicação entra em stack overflow.

How to mitigate

Implemente um limite máximo de profundidade de recursão (contador ou limite de pilha) e lance exceção se ultrapassado. Prefira iteração com pilha explícita quando possível, ou valide e sanitize a entrada para garantir que a complexidade da estrutura de dados não ultrapasse limites razoáveis.

CVE-2026-107376HIGHwebonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested inputEPSS 0.4%CVE-2025-59364MEDIUMThe express-xss-sanitizer (aka Express XSS Sanitizer) package through 2.0.0 for Node.js has an unbounded recursion depth in sanitize in lib/EPSS 0.4%CVE-2025-66031HIGHnode-forge ASN.1 Unbounded RecursionEPSS 0.4%CVE-2026-46714MEDIUMMisskey: Denial of Service via Uncontrolled Recursion in Theme CompilationEPSS 0.4%CVE-2026-45664MEDIUMImageMagick: Policy Bypass in MNG coder couldEPSS 0.4%CVE-2026-104020HIGHUncontrolled recursion in the Ion reader in Amazon Ion PythonEPSS 0.4%CVE-2026-102509HIGHApache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parserEPSS 0.4%CVE-2026-48502HIGHMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsEPSS 0.4%CVE-2026-91968HIGHvikunja before 2.6.0 Denial of Service via unbounded filter recursionEPSS 0.4%CVE-2026-100354HIGHkin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process CrashEPSS 0.4%CVE-2026-7164HIGHpf can overflow the stack parsing crafted SCTP packetsEPSS 0.4%CVE-2026-119191HIGHForge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDerEPSS 0.4%CVE-2026-66920HIGHPivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph DataEPSS 0.4%CVE-2026-78253LOWDenial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts QtEPSS 0.4%CVE-2026-53531MEDIUMratex-parser has unbounded parser recursion that leads to stack overflow (process abort)EPSS 0.4%CVE-2026-107300HIGHmsgpack5: Many buffered values can exhaust the streaming decoder stackEPSS 0.4%CVE-2026-95844HIGHMoquette deeply nested MQTT topics can cause stack exhaustionEPSS 0.4%CVE-2026-106449LOWyawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowErrorEPSS 0.4%CVE-2026-19248HIGHUnbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts QtEPSS 0.4%CVE-2026-72647MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.4%