Falhas do tipo CWE-674

346 resultados

Recursão descontrolada

Acontece quando uma função chama a si mesma (ou é chamada indiretamente por outra) sem limite adequado de profundidade, consumindo toda a memória da pilha (stack overflow). O atacante pode fornecer entrada malformada ou estruturas aninhadas excessivas para disparar recursões infinitas e derrubar a aplicação.

Exemplo

Um parser XML ou JSON que processa estruturas aninhadas recursivamente: se o atacante envia um documento com milhares de níveis de aninhamento, cada chamada recursiva consome espaço da pilha até esgotar e derrubar o processo. Outro caso: função que processa árvores sem verificar profundidade máxima.

Como mitigar

Implemente limite explícito de profundidade (máximo de níveis de recursão) e valide entrada antes de processar. Use iteração (loop) em vez de recursão quando possível, ou monitore o consumo de pilha em tempo de execução com alertas de limite.

CVE-2026-38752LOWA stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) viaEPSS 0.3%CVE-2026-38755LOWA heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplEPSS 0.3%CVE-2026-41680HIGHMarked: OOM Denial of Service via Infinite Recursion in marked TokenizerEPSS 0.3%CVE-2025-5472MEDIUMDenial of Service via Uncontrolled Recursive JSON Parsing in JSONReader in run-llama/llama_indexEPSS 0.3%CVE-2026-84851HIGHUncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6EPSS 0.3%CVE-2026-62296HIGHHAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of serviceEPSS 0.3%CVE-2026-74787HIGHScriban before 7.0.0 Uncontrolled Recursion via object.to_jsonEPSS 0.3%CVE-2026-62295HIGHHAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of serviceEPSS 0.3%CVE-2026-90472MEDIUMmsgpack-java through 0.9.12 Stack Overflow via Nested ArraysEPSS 0.3%CVE-2026-52132HIGHllama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_allEPSS 0.3%CVE-2026-72679MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.3%CVE-2026-82604MEDIUMBareBones BBEdit Java Language recursionEPSS 0.3%CVE-2026-40879HIGHNest: DoS via Recursive handleData in JsonSocket (TCP Transport)EPSS 0.3%CVE-2026-49941HIGHNet::CIDR::Set versions through 0.20 for Perl did not validate IP addressesEPSS 0.3%CVE-2026-39376HIGHFastFeedParser has an infinite redirect loop DoS via meta-refresh chainEPSS 0.3%CVE-2026-9358MEDIUMpostcss-selector-parser AST Serialization container.js toString recursionEPSS 0.3%CVE-2026-59156MEDIUMOpenImageIO: Unbounded recursion in FITS header parser leads to stack overflowEPSS 0.3%CVE-2026-73209MEDIUMAn attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. TheEPSS 0.3%CVE-2025-50420MEDIUMAn issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted EPSS 0.3%CVE-2026-74795HIGHScriban before 6.6.0 Denial of Service via Uncontrolled RecursionEPSS 0.3%