Fallos del tipo CWE-674

348 resultados

Recursão não controlada

Ocorre quando uma função chama a si mesma ou a outras funções de forma cíclica sem um limite adequado de profundidade, esgotando a pilha de execução (stack overflow). O risco é causar negação de serviço ou crash da aplicação, frequentemente disparado por entrada maliciosa ou dados estruturados recursivamente.

Ejemplo

Um parser XML ou JSON que não valida a profundidade de aninhamento pode sofrer recursão infinita ao processar um documento atacante com centenas de níveis aninhados, consumindo toda a memória de pilha e derrubando o serviço.

Cómo mitigar

Implemente limites de profundidade em algoritmos recursivos (máximo de chamadas aninhadas), use iteração com pilha explícita quando possível, e valide a entrada antes de processar estruturas potencialmente recursivas. Teste com payloads de aninhamento profundo.

CVE-2026-41311HIGHLiquidJS is vulnerable to Denial of Service via circular block reference in layoutEPSS 0.4%CVE-2026-73566HIGHnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionEPSS 0.4%CVE-2025-61766MEDIUMBucket vulnerable to infinite recursion when querying a bucket using the != operatorEPSS 0.4%CVE-2026-47180MEDIUMZeroconf: Unbounded recursion in DNS compression-pointer decoder allows LAN-local denial of serviceEPSS 0.4%CVE-2025-36001MEDIUMIBM Db2 Denial of ServiceEPSS 0.4%CVE-2026-72686MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-91968HIGHvikunja before 2.6.0 Denial of Service via unbounded filter recursionEPSS 0.4%CVE-2026-72683MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-89418HIGHUncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)EPSS 0.4%CVE-2025-20678MEDIUMIn ims service, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has cEPSS 0.4%CVE-2026-66393HIGHNLTK before 3.9.4 Denial of Service via JSONTaggedDecoderEPSS 0.4%CVE-2024-58264LOWThe serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.EPSS 0.4%CVE-2026-67321MEDIUMaxios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypassEPSS 0.4%CVE-2026-77465HIGHtoml-node: Uncontrolled RecursionEPSS 0.4%CVE-2026-6811MEDIUMPHP Stack ExhaustionEPSS 0.4%CVE-2025-6710HIGHPre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDBEPSS 0.4%CVE-2025-70957HIGHA Denial of Service (DoS) vulnerability was discovered in the TON Lite Server before v2024.09. The vulnerability arises from the handling ofEPSS 0.4%CVE-2025-54858HIGHBIG-IP Advanced WAF and ASM vulnerabilityEPSS 0.3%CVE-2024-58102MEDIUMAn issue was discovered in Datalust Seq before 2024.3.13545. An insecure default parsing depth limit allows stack consumption when parsing uEPSS 0.3%CVE-2026-54623HIGHdjango CMS: Plugin move endpoint allows cyclic reparenting (DoS)EPSS 0.3%