Fallos del tipo CWE-674

348 resultados

Recursão não controlada

Ocorre quando uma função chama a si mesma ou a outras funções de forma cíclica sem um limite adequado de profundidade, esgotando a pilha de execução (stack overflow). O risco é causar negação de serviço ou crash da aplicação, frequentemente disparado por entrada maliciosa ou dados estruturados recursivamente.

Ejemplo

Um parser XML ou JSON que não valida a profundidade de aninhamento pode sofrer recursão infinita ao processar um documento atacante com centenas de níveis aninhados, consumindo toda a memória de pilha e derrubando o serviço.

Cómo mitigar

Implemente limites de profundidade em algoritmos recursivos (máximo de chamadas aninhadas), use iteração com pilha explícita quando possível, e valide a entrada antes de processar estruturas potencialmente recursivas. Teste com payloads de aninhamento profundo.

CVE-2026-47317MEDIUMUncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects Escargot: 590345cc6258EPSS 0.3%CVE-2026-47309MEDIUMUncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads. This issue affects EscargotEPSS 0.3%CVE-2026-46373HIGHSQLFluff: Recursive Stack Overflow in ParserEPSS 0.3%CVE-2026-45740MEDIUMprotobufjs: Denial of Service via unbounded recursive JSON descriptor expansionEPSS 0.3%CVE-2026-47851HIGHUnbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document ReaderEPSS 0.3%CVE-2026-46714MEDIUMMisskey: Denial of Service via Uncontrolled Recursion in Theme CompilationEPSS 0.3%CVE-2026-16192HIGHIBM WebSphere Application Server Liberty is affected by a denial of serviceEPSS 0.3%CVE-2026-22591HIGHFast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS)EPSS 0.3%CVE-2025-71393MEDIUMSurrealDB before 2.2.2 Memory Exhaustion via Nested FunctionsEPSS 0.3%CVE-2025-4565HIGHUnbounded recursion in Python ProtobufEPSS 0.3%CVE-2026-66920HIGHPivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph DataEPSS 0.3%CVE-2026-88763MEDIUMSkupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of serviceEPSS 0.3%CVE-2026-63144MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.2%CVE-2026-6936MEDIUMIBM i is Affected by a Denial of Service Vulnerability []EPSS 0.2%CVE-2026-54888MEDIUMUncontrolled recursion over deeply nested Markdown crashes the BEAM in mdexEPSS 0.2%CVE-2026-16440MEDIUMIn Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault.EPSS 0.2%CVE-2020-36691MEDIUMAn issue was discovered in the Linux kernel before 5.8. lib/nlattr.c allows attackers to cause a denial of service (unbounded recursion) viaEPSS 0.2%CVE-2026-33947MEDIUMjq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted()EPSS 0.2%CVE-2026-34536MEDIUMiccDEV: SO in SIccCalcOp::ArgsUsed()EPSS 0.2%CVE-2024-25112MEDIUMDenial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder in Exiv2EPSS 0.2%