Falhas do tipo CWE-674

457 resultados

Recursão descontrolada

Acontece quando uma função chama a si mesma (ou é chamada indiretamente por outra) sem limite adequado de profundidade, consumindo toda a memória da pilha (stack overflow). O atacante pode fornecer entrada malformada ou estruturas aninhadas excessivas para disparar recursões infinitas e derrubar a aplicação.

Exemplo

Um parser XML ou JSON que processa estruturas aninhadas recursivamente: se o atacante envia um documento com milhares de níveis de aninhamento, cada chamada recursiva consome espaço da pilha até esgotar e derrubar o processo. Outro caso: função que processa árvores sem verificar profundidade máxima.

Como mitigar

Implemente limite explícito de profundidade (máximo de níveis de recursão) e valide entrada antes de processar. Use iteração (loop) em vez de recursão quando possível, ou monitore o consumo de pilha em tempo de execução com alertas de limite.

CVE-2026-45205MEDIUMApache Commons Configuration: StackOverflowError for YAML input with cyclesEPSS 0.5%CVE-2025-46206MEDIUMAn issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool cleaEPSS 0.5%CVE-2024-0210HIGHUncontrolled Recursion in WiresharkEPSS 0.5%CVE-2026-114605HIGHdnspython dns.name.from_wire_parser() excessive CPU useEPSS 0.5%CVE-2026-55862MEDIUMpupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflowEPSS 0.5%CVE-2026-54426HIGHApache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply ParserEPSS 0.5%CVE-2025-71393MEDIUMSurrealDB before 2.2.2 Memory Exhaustion via Nested FunctionsEPSS 0.5%CVE-2026-107826HIGHOWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)EPSS 0.5%CVE-2026-47851HIGHUnbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document ReaderEPSS 0.5%CVE-2026-48712HIGHprotobufjs: Denial of service through unbounded Any expansion during JSON conversionEPSS 0.5%CVE-2026-95861HIGHA malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices toEPSS 0.5%CVE-2026-22591HIGHFast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS)EPSS 0.5%CVE-2026-32327CRITICALApache Portable Runtime Utility: apr-util XML stack recursion crashEPSS 0.5%CVE-2026-81724MEDIUMNLTK before 3.10.3 Denial of Service via Uncontrolled RecursionEPSS 0.5%CVE-2026-102276HIGHbrace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionEPSS 0.5%CVE-2026-41636HIGHApache Thrift: Node.js skip() recursionEPSS 0.5%CVE-2024-58103MEDIUMSquare Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.EPSS 0.4%CVE-2026-63759HIGHSurrealDB before 3.1.0 Denial of Service nested type annotationsEPSS 0.4%CVE-2026-107376HIGHwebonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested inputEPSS 0.4%CVE-2025-59364MEDIUMThe express-xss-sanitizer (aka Express XSS Sanitizer) package through 2.0.0 for Node.js has an unbounded recursion depth in sanitize in lib/EPSS 0.4%