Falhas do tipo CWE-674

457 resultados

Recursão descontrolada

Acontece quando uma função chama a si mesma (ou é chamada indiretamente por outra) sem limite adequado de profundidade, consumindo toda a memória da pilha (stack overflow). O atacante pode fornecer entrada malformada ou estruturas aninhadas excessivas para disparar recursões infinitas e derrubar a aplicação.

Exemplo

Um parser XML ou JSON que processa estruturas aninhadas recursivamente: se o atacante envia um documento com milhares de níveis de aninhamento, cada chamada recursiva consome espaço da pilha até esgotar e derrubar o processo. Outro caso: função que processa árvores sem verificar profundidade máxima.

Como mitigar

Implemente limite explícito de profundidade (máximo de níveis de recursão) e valide entrada antes de processar. Use iteração (loop) em vez de recursão quando possível, ou monitore o consumo de pilha em tempo de execução com alertas de limite.

CVE-2026-63144MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-72636MEDIUMUncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of ServiceEPSS 0.4%CVE-2026-95179HIGHAn issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animatiEPSS 0.4%CVE-2026-119187HIGHForge: Denial of service in TLS record processing via call stack exhaustionEPSS 0.4%CVE-2026-49847HIGHFreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSONEPSS 0.4%CVE-2026-115290HIGHUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-15957HIGHUncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapesEPSS 0.4%CVE-2026-34211MEDIUMSandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parserEPSS 0.4%CVE-2026-103006MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-59645HIGHOER parser recurses without depth limit on self-referential IEEE 1609.2 schemaEPSS 0.4%CVE-2026-48513MEDIUMMessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcementEPSS 0.4%CVE-2026-48512MEDIUMMessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcementEPSS 0.4%CVE-2026-109264MEDIUMImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG DecoderEPSS 0.4%CVE-2026-8168HIGHDenial-of-service vulnerability in the SVG parser and renderer impacts QtEPSS 0.4%CVE-2025-43708LOWVisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowErrorEPSS 0.4%CVE-2026-54269MEDIUMprotobufjs: Schema-derived names can shadow runtime-significant propertiesEPSS 0.4%CVE-2026-119137MEDIUMWasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type RegistryEPSS 0.4%CVE-2021-28210—An unlimited recursion in DxeCore in EDK II.EPSS 0.4%CVE-2026-63475MEDIUMisomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)EPSS 0.4%CVE-2026-103087HIGHUncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cEPSS 0.4%