Weaknesses of type CWE-674

458 results

Recursão descontrolada

Ocorre quando uma função chama a si mesma (ou a outras funções em cadeia) sem limite adequado de profundidade, consumindo toda a pilha de execução até causar travamento ou crash. O risco é permitir que dados não validados ou entrada do usuário definam a profundidade da recursão, tornando fácil um ataque de negação de serviço.

Example

Um parser XML que processa elementos aninhados chamando recursivamente a si mesmo para cada nível, sem verificar a profundidade máxima. Um atacante envia um arquivo com milhares de tags aninhadas e a aplicação entra em stack overflow.

How to mitigate

Implemente um limite máximo de profundidade de recursão (contador ou limite de pilha) e lance exceção se ultrapassado. Prefira iteração com pilha explícita quando possível, ou valide e sanitize a entrada para garantir que a complexidade da estrutura de dados não ultrapasse limites razoáveis.

CVE-2026-1849HIGHMongod can run out of stack memory when expressions create deeply nested documentsEPSS 0.3%CVE-2026-9358MEDIUMpostcss-selector-parser AST Serialization container.js toString recursionEPSS 0.3%CVE-2024-49363HIGHUncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in MisskeyEPSS 0.3%CVE-2026-64860MEDIUMespressif/mdns has Uncontrolled Recursion in mDNS Name DecompressionEPSS 0.3%CVE-2026-46689HIGHKanidm: Unauthenticated process abort via SCIM filter stack exhaustionEPSS 0.3%CVE-2026-121092HIGHUncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code insideEPSS 0.3%CVE-2024-57257LOWA stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting.EPSS 0.3%CVE-2026-92876HIGHIBM Maximo Application Suite - IoT Component Denial of ServiceEPSS 0.3%CVE-2026-90912HIGHMaximo AI Service Denial of ServiceEPSS 0.3%CVE-2025-33096MEDIUMIBM Engineering Requirements Management Doors Next denial of serviceEPSS 0.3%CVE-2022-47662MEDIUMGPAC MP4Box 2.1-DEV-rev649-ga8f438d20 has a segment fault (/stack overflow) due to infinite recursion in Media_GetSample isomedia/media.c:66EPSS 0.3%CVE-2026-103008MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.3%CVE-2026-102409MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.3%CVE-2026-62303MEDIUMPistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)EPSS 0.3%CVE-2026-66858HIGHApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)EPSS 0.3%CVE-2023-2664LOWStack overflow in Xpdf 4.04 due to object loop in PDF embedded file treeEPSS 0.3%CVE-2024-2965MEDIUMDenial-of-Service in LangChain SitemapLoader in langchain-ai/langchainEPSS 0.3%CVE-2026-94650HIGHApache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)EPSS 0.3%CVE-2026-107208MEDIUMImageMagick: Denial of service with crafted XMP profileEPSS 0.3%CVE-2025-1492HIGHUncontrolled Recursion in WiresharkEPSS 0.3%