Falhas do tipo CWE-674

346 resultados

Recursão descontrolada

Acontece quando uma função chama a si mesma (ou é chamada indiretamente por outra) sem limite adequado de profundidade, consumindo toda a memória da pilha (stack overflow). O atacante pode fornecer entrada malformada ou estruturas aninhadas excessivas para disparar recursões infinitas e derrubar a aplicação.

Exemplo

Um parser XML ou JSON que processa estruturas aninhadas recursivamente: se o atacante envia um documento com milhares de níveis de aninhamento, cada chamada recursiva consome espaço da pilha até esgotar e derrubar o processo. Outro caso: função que processa árvores sem verificar profundidade máxima.

Como mitigar

Implemente limite explícito de profundidade (máximo de níveis de recursão) e valide entrada antes de processar. Use iteração (loop) em vez de recursão quando possível, ou monitore o consumo de pilha em tempo de execução com alertas de limite.

CVE-2020-1898—The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could causeEPSS 1.2%CVE-2022-1771MEDIUMUncontrolled Recursion in vim/vimEPSS 1.2%CVE-2024-27454HIGHorjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.EPSS 1.2%CVE-2023-1370HIGHStack exhaustion in json-smart leads to denial of service when parsing malformed JSONEPSS 1.1%CVE-2026-69378HIGHMicrosoft Exchange Server Denial of Service VulnerabilityEPSS 1.1%CVE-2026-41606MEDIUMApache Thrift: c_glib dispatch stack overflowEPSS 1.1%CVE-2022-23516HIGHUncontrolled Recursion in LoofahEPSS 1.1%CVE-2024-34158HIGHStack exhaustion in Parse in go/build/constraintEPSS 1.0%CVE-2022-23606MEDIUMCrash when a cluster is deleted in EnvoyEPSS 1.0%CVE-2024-31228MEDIUMDenial-of-service due to unbounded pattern matching in RedisEPSS 1.0%CVE-2023-1436MEDIUMInfinite recursion in Jettison leads to denial of service when creating a crafted JSONArrayEPSS 1.0%CVE-2024-43414HIGHApollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queriesEPSS 1.0%CVE-2022-31099MEDIUMUncontrolled Recursion in rulexEPSS 0.9%CVE-2022-46405HIGHMastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attackeEPSS 0.9%CVE-2026-40324CRITICALHot Chocolate's Utf8GraphQLParser has Stack Overflow via Deeply Nested GraphQL DocumentsEPSS 0.9%CVE-2026-0990MEDIUMLibxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processingEPSS 0.9%CVE-2022-37034MEDIUMIn dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large fileEPSS 0.9%CVE-2023-50251MEDIUMphp-svg-lib possible DoS caused by infinite recursion when parsing SVG documentEPSS 0.9%CVE-2023-31893HIGHTelefnica Brasil Vivo Play (IPTV) Firmware: 2023.04.04.01.06.15 is vulnerable to Denial of Service (DoS) via DNS Recursion.EPSS 0.9%CVE-2025-53864MEDIUMConnect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeplEPSS 0.8%