Weaknesses of type CWE-674

346 results

Recursão descontrolada

Ocorre quando uma função chama a si mesma (ou a outras funções em cadeia) sem limite adequado de profundidade, consumindo toda a pilha de execução até causar travamento ou crash. O risco é permitir que dados não validados ou entrada do usuário definam a profundidade da recursão, tornando fácil um ataque de negação de serviço.

Example

Um parser XML que processa elementos aninhados chamando recursivamente a si mesmo para cada nível, sem verificar a profundidade máxima. Um atacante envia um arquivo com milhares de tags aninhadas e a aplicação entra em stack overflow.

How to mitigate

Implemente um limite máximo de profundidade de recursão (contador ou limite de pilha) e lance exceção se ultrapassado. Prefira iteração com pilha explícita quando possível, ou valide e sanitize a entrada para garantir que a complexidade da estrutura de dados não ultrapasse limites razoáveis.

CVE-2026-61483HIGHApache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoSEPSS 0.8%CVE-2026-32141HIGHflatted: Unbounded recursion DoS in parse() revive phaseEPSS 0.8%CVE-2024-1899MEDIUMShowdownjs Denial of ServiceEPSS 0.8%CVE-2023-49800HIGHDenial of service by abusing `fetchOptions.retry` in nuxt-api-partyEPSS 0.8%CVE-2026-30922HIGHpyasn1 Vulnerable to Denial of Service via Unbounded RecursionEPSS 0.8%CVE-2024-20311HIGHA vulnerability in the Locator ID Separation Protocol (LISP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenEPSS 0.8%CVE-2022-27810—It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript.EPSS 0.8%CVE-2024-32609HIGHHDF5 Library through 1.14.3 allows stack consumption in the function H5E_printf_stack in H5Eint.c.EPSS 0.8%CVE-2022-3222MEDIUMUncontrolled Recursion in gpac/gpacEPSS 0.8%CVE-2026-42039MEDIUMAxios: unbounded recursion in toFormData causes DoS via deeply nested request dataEPSS 0.7%CVE-2021-36395HIGHIn Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.EPSS 0.7%CVE-2024-47831MEDIUMNext.js image optimization has Denial of Service conditionEPSS 0.7%CVE-2021-30471—A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call in PdfNamesTree::AddToDictionary function in src/podofo/doc/PdfNamesTree.cpEPSS 0.7%CVE-2026-0994HIGHDenial of Service in Python ProtobufEPSS 0.7%CVE-2022-47374HIGHA vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400EPSS 0.7%CVE-2026-3520HIGHMulter vulnerable to Denial of Service via uncontrolled recursionEPSS 0.7%CVE-2026-25048HIGHxgrammar: Multi-layer nesting causes DoSEPSS 0.7%CVE-2023-51803CRITICALLinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "<?php ?>" substring.EPSS 0.7%CVE-2021-30470—A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call among PdfTokenizer::ReadArray(), PdfTokenizer::GetNextVariant() and PdfTokeEPSS 0.7%CVE-2026-4224MEDIUMStack overflow parsing XML with deeply nested DTD content modelsEPSS 0.7%