Falhas do tipo CWE-674

458 resultados

Recursão descontrolada

Acontece quando uma função chama a si mesma (ou é chamada indiretamente por outra) sem limite adequado de profundidade, consumindo toda a memória da pilha (stack overflow). O atacante pode fornecer entrada malformada ou estruturas aninhadas excessivas para disparar recursões infinitas e derrubar a aplicação.

Exemplo

Um parser XML ou JSON que processa estruturas aninhadas recursivamente: se o atacante envia um documento com milhares de níveis de aninhamento, cada chamada recursiva consome espaço da pilha até esgotar e derrubar o processo. Outro caso: função que processa árvores sem verificar profundidade máxima.

Como mitigar

Implemente limite explícito de profundidade (máximo de níveis de recursão) e valide entrada antes de processar. Use iteração (loop) em vez de recursão quando possível, ou monitore o consumo de pilha em tempo de execução com alertas de limite.

CVE-2026-16440MEDIUMIn Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault.EPSS 0.3%CVE-2026-47706MEDIUMStrawberry GraphQL has a Circular Fragment Reference DOSEPSS 0.3%CVE-2026-123660MEDIUMVulnerability-Lookup: memory amplification through webhook payload template format specifiersEPSS 0.3%CVE-2024-3247LOWStack overflow in Xpdf 4.05 due to object loop in PDF object streamEPSS 0.3%CVE-2026-75655HIGHBridge | Uncontrolled Recursion (CWE-674)EPSS 0.3%CVE-2026-103118MEDIUMGraphicsMagick WPG File wpg.c ExtractPostscript recursionEPSS 0.3%CVE-2026-118035HIGHUncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessingEPSS 0.3%CVE-2026-116586MEDIUMGo JOSE: Panics in JSON parsingEPSS 0.3%CVE-2024-3248LOWStack overflow in Xpdf 4.05 due to object loop in attachmentsEPSS 0.3%CVE-2026-109267MEDIUMImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL DecoderEPSS 0.3%CVE-2025-5302HIGHDenial of Service (DOS) in JSONReader in run-llama/llama_indexEPSS 0.3%CVE-2026-85493HIGHApache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)EPSS 0.3%CVE-2026-89418HIGHUncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)EPSS 0.3%CVE-2026-83663HIGHApache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)EPSS 0.3%CVE-2026-19498MEDIUMSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.3%CVE-2026-19201MEDIUMDenial of Service via Unbounded Recursion in go-attestation Windows SIPA ParserEPSS 0.3%CVE-2026-118037HIGHUncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessingEPSS 0.3%CVE-2026-4870HIGHQiskit SDK is vulnerable to specific functions may recurse too deeply and overflow the available stack space, when encountering certain classical expressions.EPSS 0.3%CVE-2026-41935HIGHVvveb < 1.0.8.3 Uncontrolled Recursion Denial of ServiceEPSS 0.3%CVE-2026-47309MEDIUMUncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads. This issue affects EscargotEPSS 0.3%