Falhas do tipo CWE-674

450 resultados

Recursão descontrolada

Acontece quando uma função chama a si mesma (ou é chamada indiretamente por outra) sem limite adequado de profundidade, consumindo toda a memória da pilha (stack overflow). O atacante pode fornecer entrada malformada ou estruturas aninhadas excessivas para disparar recursões infinitas e derrubar a aplicação.

Exemplo

Um parser XML ou JSON que processa estruturas aninhadas recursivamente: se o atacante envia um documento com milhares de níveis de aninhamento, cada chamada recursiva consome espaço da pilha até esgotar e derrubar o processo. Outro caso: função que processa árvores sem verificar profundidade máxima.

Como mitigar

Implemente limite explícito de profundidade (máximo de níveis de recursão) e valide entrada antes de processar. Use iteração (loop) em vez de recursão quando possível, ou monitore o consumo de pilha em tempo de execução com alertas de limite.

CVE-2026-76098HIGHMistune has Denial of Service — RecursionError via Excessive Emphasis Markers in MarkdownEPSS 0.5%CVE-2026-62295HIGHHAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of serviceEPSS 0.5%CVE-2026-54623HIGHdjango CMS: Plugin move endpoint allows cyclic reparenting (DoS)EPSS 0.5%CVE-2026-63737HIGHSurrealDB before 3.1.5 Denial of Service via deep operator chainsEPSS 0.5%CVE-2024-58370HIGHSurrealDB before 1.1.0 Uncontrolled Recursion Denial of ServiceEPSS 0.5%CVE-2026-61847MEDIUMCrass: A large number of adjacent CSS comments can trigger a SystemStackErrorEPSS 0.5%CVE-2026-61846MEDIUMCrass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usageEPSS 0.5%CVE-2026-110673HIGHCpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tagEPSS 0.5%CVE-2025-57809HIGHXGrammar affected by Denial of Service by infinite recursion grammarsEPSS 0.5%CVE-2026-92564HIGHApache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processingEPSS 0.5%CVE-2024-42369MEDIUMA room with itself as a its predecessor will freeze matrix-js-sdkEPSS 0.5%CVE-2021-41737HIGHIn Faust 2.23.1, an input file with the lines "// r visualisation tCst" and "//process = +: L: abM-^Q;" and "process = route(333333333333333EPSS 0.5%CVE-2023-2663LOWStack overflow in Xpdf 4.04 due to object loop in PDF page label treeEPSS 0.5%CVE-2026-113650MEDIUMApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)EPSS 0.5%CVE-2025-53605MEDIUMThe protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parEPSS 0.5%CVE-2026-56148MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.5%CVE-2026-72679MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.5%CVE-2026-106447HIGHStableLib: Stack exhaustion denial of service via deeply nested CBOR arrays, maps, or tagsEPSS 0.5%CVE-2026-48506HIGHMessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depthEPSS 0.5%CVE-2026-33498HIGHParse Server: Query condition depth bypass via pre-validation transform pipelineEPSS 0.5%