Falhas do tipo CWE-674

346 resultados

Recursão descontrolada

Acontece quando uma função chama a si mesma (ou é chamada indiretamente por outra) sem limite adequado de profundidade, consumindo toda a memória da pilha (stack overflow). O atacante pode fornecer entrada malformada ou estruturas aninhadas excessivas para disparar recursões infinitas e derrubar a aplicação.

Exemplo

Um parser XML ou JSON que processa estruturas aninhadas recursivamente: se o atacante envia um documento com milhares de níveis de aninhamento, cada chamada recursiva consome espaço da pilha até esgotar e derrubar o processo. Outro caso: função que processa árvores sem verificar profundidade máxima.

Como mitigar

Implemente limite explícito de profundidade (máximo de níveis de recursão) e valide entrada antes de processar. Use iteração (loop) em vez de recursão quando possível, ou monitore o consumo de pilha em tempo de execução com alertas de limite.

CVE-2025-61766MEDIUMBucket vulnerable to infinite recursion when querying a bucket using the != operatorEPSS 0.4%CVE-2026-47180MEDIUMZeroconf: Unbounded recursion in DNS compression-pointer decoder allows LAN-local denial of serviceEPSS 0.4%CVE-2026-72686MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-91968HIGHvikunja before 2.6.0 Denial of Service via unbounded filter recursionEPSS 0.4%CVE-2026-72683MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2025-36001MEDIUMIBM Db2 Denial of ServiceEPSS 0.4%CVE-2026-89418HIGHUncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)EPSS 0.4%CVE-2025-20678MEDIUMIn ims service, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has cEPSS 0.4%CVE-2026-66393HIGHNLTK before 3.9.4 Denial of Service via JSONTaggedDecoderEPSS 0.4%CVE-2024-58264LOWThe serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.EPSS 0.4%CVE-2026-67321MEDIUMaxios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypassEPSS 0.4%CVE-2026-77465HIGHtoml-node: Uncontrolled RecursionEPSS 0.4%CVE-2026-6811MEDIUMPHP Stack ExhaustionEPSS 0.4%CVE-2025-6710HIGHPre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDBEPSS 0.4%CVE-2025-70957HIGHA Denial of Service (DoS) vulnerability was discovered in the TON Lite Server before v2024.09. The vulnerability arises from the handling ofEPSS 0.4%CVE-2025-54858HIGHBIG-IP Advanced WAF and ASM vulnerabilityEPSS 0.3%CVE-2024-58102MEDIUMAn issue was discovered in Datalust Seq before 2024.3.13545. An insecure default parsing depth limit allows stack consumption when parsing uEPSS 0.3%CVE-2026-54623HIGHdjango CMS: Plugin move endpoint allows cyclic reparenting (DoS)EPSS 0.3%CVE-2026-9740HIGHUnbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflowEPSS 0.3%CVE-2026-33508HIGHParse Server: LiveQuery subscription query depth bypassEPSS 0.3%