Weaknesses of type CWE-674

458 results

Recursão descontrolada

Ocorre quando uma função chama a si mesma (ou a outras funções em cadeia) sem limite adequado de profundidade, consumindo toda a pilha de execução até causar travamento ou crash. O risco é permitir que dados não validados ou entrada do usuário definam a profundidade da recursão, tornando fácil um ataque de negação de serviço.

Example

Um parser XML que processa elementos aninhados chamando recursivamente a si mesmo para cada nível, sem verificar a profundidade máxima. Um atacante envia um arquivo com milhares de tags aninhadas e a aplicação entra em stack overflow.

How to mitigate

Implemente um limite máximo de profundidade de recursão (contador ou limite de pilha) e lance exceção se ultrapassado. Prefira iteração com pilha explícita quando possível, ou valide e sanitize a entrada para garantir que a complexidade da estrutura de dados não ultrapasse limites razoáveis.

CVE-2026-73209MEDIUMAn attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. TheEPSS 0.4%CVE-2026-63475MEDIUMisomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)EPSS 0.4%CVE-2026-26209HIGHcbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loadsEPSS 0.4%CVE-2026-44844MEDIUMeml_parser: Recursion DoS via nested message/rfc822 attachmentsEPSS 0.4%CVE-2026-84175MEDIUMIn Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API useEPSS 0.4%CVE-2026-109413HIGHSymfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the ProcessEPSS 0.4%CVE-2025-70957HIGHA Denial of Service (DoS) vulnerability was discovered in the TON Lite Server before v2024.09. The vulnerability arises from the handling ofEPSS 0.4%CVE-2026-44031HIGHUncontrolled recursion in the DCMTK DICOM dataset parser allows unauthenticated remote denial of serviceEPSS 0.4%CVE-2026-44740MEDIUMgo-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustionEPSS 0.4%CVE-2025-5472MEDIUMDenial of Service via Uncontrolled Recursive JSON Parsing in JSONReader in run-llama/llama_indexEPSS 0.4%CVE-2026-107833MEDIUMOWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustionEPSS 0.4%CVE-2025-36001MEDIUMIBM Db2 Denial of ServiceEPSS 0.4%CVE-2026-58227HIGHTLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chainEPSS 0.4%CVE-2026-11573HIGHUncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)EPSS 0.4%CVE-2026-116871HIGHSemantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:AskEPSS 0.4%CVE-2025-61766MEDIUMBucket vulnerable to infinite recursion when querying a bucket using the != operatorEPSS 0.4%CVE-2026-106572MEDIUMImageMagick: Stack Overflown CALS decoder due to missing depth check.EPSS 0.4%CVE-2026-41311HIGHLiquidJS is vulnerable to Denial of Service via circular block reference in layoutEPSS 0.4%CVE-2025-6710HIGHPre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDBEPSS 0.4%CVE-2026-91765HIGHSOAP: Unbounded Recursion in Server-Side cleanup_xml_nodeEPSS 0.4%