Falhas do tipo CWE-674

458 resultados

Recursão descontrolada

Acontece quando uma função chama a si mesma (ou é chamada indiretamente por outra) sem limite adequado de profundidade, consumindo toda a memória da pilha (stack overflow). O atacante pode fornecer entrada malformada ou estruturas aninhadas excessivas para disparar recursões infinitas e derrubar a aplicação.

Exemplo

Um parser XML ou JSON que processa estruturas aninhadas recursivamente: se o atacante envia um documento com milhares de níveis de aninhamento, cada chamada recursiva consome espaço da pilha até esgotar e derrubar o processo. Outro caso: função que processa árvores sem verificar profundidade máxima.

Como mitigar

Implemente limite explícito de profundidade (máximo de níveis de recursão) e valide entrada antes de processar. Use iteração (loop) em vez de recursão quando possível, ou monitore o consumo de pilha em tempo de execução com alertas de limite.

CVE-2026-1849HIGHMongod can run out of stack memory when expressions create deeply nested documentsEPSS 0.3%CVE-2026-9358MEDIUMpostcss-selector-parser AST Serialization container.js toString recursionEPSS 0.3%CVE-2024-49363HIGHUncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in MisskeyEPSS 0.3%CVE-2026-64860MEDIUMespressif/mdns has Uncontrolled Recursion in mDNS Name DecompressionEPSS 0.3%CVE-2026-46689HIGHKanidm: Unauthenticated process abort via SCIM filter stack exhaustionEPSS 0.3%CVE-2026-121092HIGHUncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code insideEPSS 0.3%CVE-2024-57257LOWA stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting.EPSS 0.3%CVE-2026-92876HIGHIBM Maximo Application Suite - IoT Component Denial of ServiceEPSS 0.3%CVE-2026-90912HIGHMaximo AI Service Denial of ServiceEPSS 0.3%CVE-2025-33096MEDIUMIBM Engineering Requirements Management Doors Next denial of serviceEPSS 0.3%CVE-2022-47662MEDIUMGPAC MP4Box 2.1-DEV-rev649-ga8f438d20 has a segment fault (/stack overflow) due to infinite recursion in Media_GetSample isomedia/media.c:66EPSS 0.3%CVE-2026-103008MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.3%CVE-2026-102409MEDIUMUncontrolled Recursion in Elasticsearch Leading to Denial of ServiceEPSS 0.3%CVE-2026-62303MEDIUMPistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)EPSS 0.3%CVE-2026-66858HIGHApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)EPSS 0.3%CVE-2023-2664LOWStack overflow in Xpdf 4.04 due to object loop in PDF embedded file treeEPSS 0.3%CVE-2024-2965MEDIUMDenial-of-Service in LangChain SitemapLoader in langchain-ai/langchainEPSS 0.3%CVE-2026-94650HIGHApache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)EPSS 0.3%CVE-2026-107208MEDIUMImageMagick: Denial of service with crafted XMP profileEPSS 0.3%CVE-2025-1492HIGHUncontrolled Recursion in WiresharkEPSS 0.3%