Fallos del tipo CWE-674

348 resultados

Recursão não controlada

Ocorre quando uma função chama a si mesma ou a outras funções de forma cíclica sem um limite adequado de profundidade, esgotando a pilha de execução (stack overflow). O risco é causar negação de serviço ou crash da aplicação, frequentemente disparado por entrada maliciosa ou dados estruturados recursivamente.

Ejemplo

Um parser XML ou JSON que não valida a profundidade de aninhamento pode sofrer recursão infinita ao processar um documento atacante com centenas de níveis aninhados, consumindo toda a memória de pilha e derrubando o serviço.

Cómo mitigar

Implemente limites de profundidade em algoritmos recursivos (máximo de chamadas aninhadas), use iteração com pilha explícita quando possível, e valide a entrada antes de processar estruturas potencialmente recursivas. Teste com payloads de aninhamento profundo.

CVE-2026-19248HIGHUnbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts QtEPSS 0.4%CVE-2026-48512MEDIUMMessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcementEPSS 0.4%CVE-2026-48513MEDIUMMessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcementEPSS 0.4%CVE-2026-54269MEDIUMprotobufjs: Schema-derived names can shadow runtime-significant propertiesEPSS 0.4%CVE-2026-55594MEDIUMImageMagick: Stack Overflow in MVG decoder due to missing depth check.EPSS 0.4%CVE-2026-58178HIGHApache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgeryEPSS 0.4%CVE-2026-73321HIGHXenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode ParserEPSS 0.4%CVE-2026-69220HIGHRabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoSEPSS 0.4%CVE-2021-28210—An unlimited recursion in DxeCore in EDK II.EPSS 0.4%CVE-2026-1069HIGHUncontrolled Recursion in GitLabEPSS 0.4%CVE-2025-43708LOWVisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowErrorEPSS 0.4%CVE-2026-44844MEDIUMeml_parser: Recursion DoS via nested message/rfc822 attachmentsEPSS 0.4%CVE-2026-34211MEDIUMSandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parserEPSS 0.4%CVE-2026-44740MEDIUMgo-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustionEPSS 0.4%CVE-2025-46206MEDIUMAn issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool cleaEPSS 0.4%CVE-2026-11573HIGHUncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)EPSS 0.4%CVE-2026-58227HIGHTLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chainEPSS 0.4%CVE-2026-12358HIGHSecurity vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.4%CVE-2026-41311HIGHLiquidJS is vulnerable to Denial of Service via circular block reference in layoutEPSS 0.4%CVE-2026-73566HIGHnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionEPSS 0.4%