Falhas do tipo CWE-674

458 resultados

Recursão descontrolada

Acontece quando uma função chama a si mesma (ou é chamada indiretamente por outra) sem limite adequado de profundidade, consumindo toda a memória da pilha (stack overflow). O atacante pode fornecer entrada malformada ou estruturas aninhadas excessivas para disparar recursões infinitas e derrubar a aplicação.

Exemplo

Um parser XML ou JSON que processa estruturas aninhadas recursivamente: se o atacante envia um documento com milhares de níveis de aninhamento, cada chamada recursiva consome espaço da pilha até esgotar e derrubar o processo. Outro caso: função que processa árvores sem verificar profundidade máxima.

Como mitigar

Implemente limite explícito de profundidade (máximo de níveis de recursão) e valide entrada antes de processar. Use iteração (loop) em vez de recursão quando possível, ou monitore o consumo de pilha em tempo de execução com alertas de limite.

CVE-2022-27943MEDIUMlibiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.EPSS 1.0%CVE-2026-61551HIGHIcinga 2: Stack overflow via deeply nested JSON objectsEPSS 0.9%CVE-2026-40324CRITICALHot Chocolate's Utf8GraphQLParser has Stack Overflow via Deeply Nested GraphQL DocumentsEPSS 0.9%CVE-2022-27810—It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript.EPSS 0.9%CVE-2022-37034MEDIUMIn dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large fileEPSS 0.9%CVE-2023-50251MEDIUMphp-svg-lib possible DoS caused by infinite recursion when parsing SVG documentEPSS 0.9%CVE-2023-31893HIGHTelefnica Brasil Vivo Play (IPTV) Firmware: 2023.04.04.01.06.15 is vulnerable to Denial of Service (DoS) via DNS Recursion.EPSS 0.9%CVE-2026-32141HIGHflatted: Unbounded recursion DoS in parse() revive phaseEPSS 0.8%CVE-2026-30922HIGHpyasn1 Vulnerable to Denial of Service via Unbounded RecursionEPSS 0.8%CVE-2026-3520HIGHMulter vulnerable to Denial of Service via uncontrolled recursionEPSS 0.8%CVE-2024-1899MEDIUMShowdownjs Denial of ServiceEPSS 0.8%CVE-2023-49800HIGHDenial of service by abusing `fetchOptions.retry` in nuxt-api-partyEPSS 0.8%CVE-2024-20311HIGHA vulnerability in the Locator ID Separation Protocol (LISP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenEPSS 0.8%CVE-2024-32609HIGHHDF5 Library through 1.14.3 allows stack consumption in the function H5E_printf_stack in H5Eint.c.EPSS 0.8%CVE-2026-18140HIGHUncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated serversEPSS 0.8%CVE-2022-3222MEDIUMUncontrolled Recursion in gpac/gpacEPSS 0.8%CVE-2026-93687HIGHbraces through 3.0.3 Stack Overflow via Deeply Nested PatternsEPSS 0.8%CVE-2026-67590HIGHApache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflowEPSS 0.8%CVE-2026-67552HIGHApache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authentication stackoverflowEPSS 0.8%CVE-2026-66274HIGHApache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflowEPSS 0.8%