Fallos del tipo CWE-674

348 resultados

Recursão não controlada

Ocorre quando uma função chama a si mesma ou a outras funções de forma cíclica sem um limite adequado de profundidade, esgotando a pilha de execução (stack overflow). O risco é causar negação de serviço ou crash da aplicação, frequentemente disparado por entrada maliciosa ou dados estruturados recursivamente.

Ejemplo

Um parser XML ou JSON que não valida a profundidade de aninhamento pode sofrer recursão infinita ao processar um documento atacante com centenas de níveis aninhados, consumindo toda a memória de pilha e derrubando o serviço.

Cómo mitigar

Implemente limites de profundidade em algoritmos recursivos (máximo de chamadas aninhadas), use iteração com pilha explícita quando possível, e valide a entrada antes de processar estruturas potencialmente recursivas. Teste com payloads de aninhamento profundo.

CVE-2026-91863HIGHApache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of serviceEPSS 0.5%CVE-2026-14803MEDIUMMojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoderEPSS 0.5%CVE-2026-59927MEDIUMMistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown filesEPSS 0.5%CVE-2026-22260HIGHSuricata http1: infinite recursion in decompressionEPSS 0.5%CVE-2026-63760HIGHSurrealDB before 3.1.0 Denial of Service via JSON ParserEPSS 0.5%CVE-2023-4512MEDIUMUncontrolled Recursion in WiresharkEPSS 0.5%CVE-2026-61551HIGHIcinga 2: Stack overflow via deeply nested JSON objectsEPSS 0.5%CVE-2026-33908HIGHImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()EPSS 0.5%CVE-2025-9624HIGHOpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoSEPSS 0.5%CVE-2025-1752HIGHDenial of Service in run-llama/llama_indexEPSS 0.5%CVE-2026-0989LOWLibxml2: unbounded relaxng include recursion leading to stack overflowEPSS 0.5%CVE-2026-67590HIGHApache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflowEPSS 0.5%CVE-2026-66274HIGHApache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflowEPSS 0.5%CVE-2026-31899HIGHCairoSVG vulnerable to Exponential DoS via recursive <use> element amplificationEPSS 0.5%CVE-2026-57081HIGHNet::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded inputEPSS 0.5%CVE-2026-40007HIGHApache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowErrorEPSS 0.5%CVE-2024-58370HIGHSurrealDB before 1.1.0 Uncontrolled Recursion Denial of ServiceEPSS 0.5%CVE-2026-63737HIGHSurrealDB before 3.1.5 Denial of Service via deep operator chainsEPSS 0.5%CVE-2026-54297HIGHFaraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parametersEPSS 0.5%CVE-2026-81928HIGHNet::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG recordEPSS 0.5%