Falhas do tipo CWE-674

458 resultados

Recursão descontrolada

Acontece quando uma função chama a si mesma (ou é chamada indiretamente por outra) sem limite adequado de profundidade, consumindo toda a memória da pilha (stack overflow). O atacante pode fornecer entrada malformada ou estruturas aninhadas excessivas para disparar recursões infinitas e derrubar a aplicação.

Exemplo

Um parser XML ou JSON que processa estruturas aninhadas recursivamente: se o atacante envia um documento com milhares de níveis de aninhamento, cada chamada recursiva consome espaço da pilha até esgotar e derrubar o processo. Outro caso: função que processa árvores sem verificar profundidade máxima.

Como mitigar

Implemente limite explícito de profundidade (máximo de níveis de recursão) e valide entrada antes de processar. Use iteração (loop) em vez de recursão quando possível, ou monitore o consumo de pilha em tempo de execução com alertas de limite.

CVE-2026-109449HIGHSymfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the ProcessEPSS 0.4%CVE-2026-118036HIGHUncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question AnsweringEPSS 0.4%CVE-2026-107216HIGHExcelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflowEPSS 0.4%CVE-2025-50420MEDIUMAn issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted EPSS 0.4%CVE-2026-16192HIGHIBM WebSphere Application Server Liberty is affected by a denial of serviceEPSS 0.4%CVE-2026-24401MEDIUMAvahi has Uncontrolled Recursion in lookup_handle_cname functionEPSS 0.4%CVE-2026-107298MEDIUMmsgpack5: Deeply nested input can exhaust the decoder stackEPSS 0.4%CVE-2026-61811MEDIUMWazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack ExhaustionEPSS 0.4%CVE-2026-47180MEDIUMZeroconf: Unbounded recursion in DNS compression-pointer decoder allows LAN-local denial of serviceEPSS 0.4%CVE-2026-6811MEDIUMPHP Stack ExhaustionEPSS 0.4%CVE-2026-59156MEDIUMOpenImageIO: Unbounded recursion in FITS header parser leads to stack overflowEPSS 0.4%CVE-2025-20678MEDIUMIn ims service, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has cEPSS 0.4%CVE-2026-63386MEDIUMjs-toml: Uncontrolled recursion in `load()` causes `RangeError` (stack exhaustion) on deeply nested inputEPSS 0.4%CVE-2026-111923HIGHFleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist ParsingEPSS 0.4%CVE-2026-103600HIGHUnbounded ASN.1 nesting depth causes process-terminating stack overflowEPSS 0.4%CVE-2026-33508HIGHParse Server: LiveQuery subscription query depth bypassEPSS 0.4%CVE-2024-58102MEDIUMAn issue was discovered in Datalust Seq before 2024.3.13545. An insecure default parsing depth limit allows stack consumption when parsing uEPSS 0.4%CVE-2026-119123MEDIUMImageMagick before 7.1.2-34 Stack Overflow in TIFF DecoderEPSS 0.4%CVE-2025-54858HIGHBIG-IP Advanced WAF and ASM vulnerabilityEPSS 0.3%CVE-2026-9740HIGHUnbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflowEPSS 0.3%