Falhas do tipo CWE-674

347 resultados

Recursão descontrolada

Acontece quando uma função chama a si mesma (ou é chamada indiretamente por outra) sem limite adequado de profundidade, consumindo toda a memória da pilha (stack overflow). O atacante pode fornecer entrada malformada ou estruturas aninhadas excessivas para disparar recursões infinitas e derrubar a aplicação.

Exemplo

Um parser XML ou JSON que processa estruturas aninhadas recursivamente: se o atacante envia um documento com milhares de níveis de aninhamento, cada chamada recursiva consome espaço da pilha até esgotar e derrubar o processo. Outro caso: função que processa árvores sem verificar profundidade máxima.

Como mitigar

Implemente limite explícito de profundidade (máximo de níveis de recursão) e valide entrada antes de processar. Use iteração (loop) em vez de recursão quando possível, ou monitore o consumo de pilha em tempo de execução com alertas de limite.

CVE-2026-24401MEDIUMAvahi has Uncontrolled Recursion in lookup_handle_cname functionEPSS 0.3%CVE-2026-72638MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.3%CVE-2026-52852MEDIUMTraccar: Uncontrolled Infinite Loop DoS via Group Parent CycleEPSS 0.3%CVE-2024-3248LOWStack overflow in Xpdf 4.05 due to object loop in attachmentsEPSS 0.3%CVE-2024-3247LOWStack overflow in Xpdf 4.05 due to object loop in PDF object streamEPSS 0.3%CVE-2026-84175MEDIUMIn Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API useEPSS 0.3%CVE-2025-5302HIGHDenial of Service (DOS) in JSONReader in run-llama/llama_indexEPSS 0.3%CVE-2026-1849HIGHMongod can run out of stack memory when expressions create deeply nested documentsEPSS 0.3%CVE-2026-76098HIGHMistune has Denial of Service — RecursionError via Excessive Emphasis Markers in MarkdownEPSS 0.3%CVE-2026-74783HIGHScriban 6.6.0 through 7.2.0 Parser Recursion Denial of ServiceEPSS 0.3%CVE-2026-74794HIGHScriban before 6.6.0 Denial of Service via Infinite RecursionEPSS 0.3%CVE-2026-19201MEDIUMDenial of Service via Unbounded Recursion in go-attestation Windows SIPA ParserEPSS 0.3%CVE-2026-9769HIGHjusthtml before 1.10.0 Denial of Service via deeply nested HTMLEPSS 0.3%CVE-2026-52130HIGHllama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service.EPSS 0.3%CVE-2026-4870HIGHQiskit SDK is vulnerable to specific functions may recurse too deeply and overflow the available stack space, when encountering certain classical expressions.EPSS 0.3%CVE-2026-81724MEDIUMNLTK before 3.10.3 Denial of Service via Uncontrolled RecursionEPSS 0.3%CVE-2026-41935HIGHVvveb < 1.0.8.3 Uncontrolled Recursion Denial of ServiceEPSS 0.3%CVE-2026-47309MEDIUMUncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads. This issue affects EscargotEPSS 0.3%CVE-2026-47317MEDIUMUncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects Escargot: 590345cc6258EPSS 0.3%CVE-2026-47851HIGHUnbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document ReaderEPSS 0.3%