Fallos del tipo CWE-674

348 resultados

Recursão não controlada

Ocorre quando uma função chama a si mesma ou a outras funções de forma cíclica sem um limite adequado de profundidade, esgotando a pilha de execução (stack overflow). O risco é causar negação de serviço ou crash da aplicação, frequentemente disparado por entrada maliciosa ou dados estruturados recursivamente.

Ejemplo

Um parser XML ou JSON que não valida a profundidade de aninhamento pode sofrer recursão infinita ao processar um documento atacante com centenas de níveis aninhados, consumindo toda a memória de pilha e derrubando o serviço.

Cómo mitigar

Implemente limites de profundidade em algoritmos recursivos (máximo de chamadas aninhadas), use iteração com pilha explícita quando possível, e valide a entrada antes de processar estruturas potencialmente recursivas. Teste com payloads de aninhamento profundo.

CVE-2026-54623HIGHdjango CMS: Plugin move endpoint allows cyclic reparenting (DoS)EPSS 0.3%CVE-2026-33508HIGHParse Server: LiveQuery subscription query depth bypassEPSS 0.3%CVE-2026-38755LOWA heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplEPSS 0.3%CVE-2026-38752LOWA stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) viaEPSS 0.3%CVE-2026-41680HIGHMarked: OOM Denial of Service via Infinite Recursion in marked TokenizerEPSS 0.3%CVE-2025-5472MEDIUMDenial of Service via Uncontrolled Recursive JSON Parsing in JSONReader in run-llama/llama_indexEPSS 0.3%CVE-2026-84851HIGHUncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6EPSS 0.3%CVE-2026-74787HIGHScriban before 7.0.0 Uncontrolled Recursion via object.to_jsonEPSS 0.3%CVE-2026-62295HIGHHAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of serviceEPSS 0.3%CVE-2026-62296HIGHHAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of serviceEPSS 0.3%CVE-2026-90472MEDIUMmsgpack-java through 0.9.12 Stack Overflow via Nested ArraysEPSS 0.3%CVE-2026-72679MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.3%CVE-2026-52132HIGHllama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_allEPSS 0.3%CVE-2026-82604MEDIUMBareBones BBEdit Java Language recursionEPSS 0.3%CVE-2026-40879HIGHNest: DoS via Recursive handleData in JsonSocket (TCP Transport)EPSS 0.3%CVE-2026-49941HIGHNet::CIDR::Set versions through 0.20 for Perl did not validate IP addressesEPSS 0.3%CVE-2026-39376HIGHFastFeedParser has an infinite redirect loop DoS via meta-refresh chainEPSS 0.3%CVE-2026-9358MEDIUMpostcss-selector-parser AST Serialization container.js toString recursionEPSS 0.3%CVE-2026-59156MEDIUMOpenImageIO: Unbounded recursion in FITS header parser leads to stack overflowEPSS 0.3%CVE-2026-73209MEDIUMAn attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. TheEPSS 0.3%