Weaknesses of type CWE-674

458 results

Recursão descontrolada

Ocorre quando uma função chama a si mesma (ou a outras funções em cadeia) sem limite adequado de profundidade, consumindo toda a pilha de execução até causar travamento ou crash. O risco é permitir que dados não validados ou entrada do usuário definam a profundidade da recursão, tornando fácil um ataque de negação de serviço.

Example

Um parser XML que processa elementos aninhados chamando recursivamente a si mesmo para cada nível, sem verificar a profundidade máxima. Um atacante envia um arquivo com milhares de tags aninhadas e a aplicação entra em stack overflow.

How to mitigate

Implemente um limite máximo de profundidade de recursão (contador ou limite de pilha) e lance exceção se ultrapassado. Prefira iteração com pilha explícita quando possível, ou valide e sanitize a entrada para garantir que a complexidade da estrutura de dados não ultrapasse limites razoáveis.

CVE-2026-72638MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-63144MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-72636MEDIUMUncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of ServiceEPSS 0.4%CVE-2026-95179HIGHAn issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animatiEPSS 0.4%CVE-2026-119187HIGHForge: Denial of service in TLS record processing via call stack exhaustionEPSS 0.4%CVE-2026-49847HIGHFreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSONEPSS 0.4%CVE-2026-115290HIGHUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-15957HIGHUncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapesEPSS 0.4%CVE-2026-103006MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-34211MEDIUMSandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parserEPSS 0.4%CVE-2026-59645HIGHOER parser recurses without depth limit on self-referential IEEE 1609.2 schemaEPSS 0.4%CVE-2026-48512MEDIUMMessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcementEPSS 0.4%CVE-2026-48513MEDIUMMessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcementEPSS 0.4%CVE-2026-109264MEDIUMImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG DecoderEPSS 0.4%CVE-2026-8168HIGHDenial-of-service vulnerability in the SVG parser and renderer impacts QtEPSS 0.4%CVE-2026-54269MEDIUMprotobufjs: Schema-derived names can shadow runtime-significant propertiesEPSS 0.4%CVE-2025-43708LOWVisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowErrorEPSS 0.4%CVE-2021-28210—An unlimited recursion in DxeCore in EDK II.EPSS 0.4%CVE-2026-119137MEDIUMWasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type RegistryEPSS 0.4%CVE-2026-63475MEDIUMisomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)EPSS 0.4%