Falhas do tipo CWE-674

346 resultados

Recursão descontrolada

Acontece quando uma função chama a si mesma (ou é chamada indiretamente por outra) sem limite adequado de profundidade, consumindo toda a memória da pilha (stack overflow). O atacante pode fornecer entrada malformada ou estruturas aninhadas excessivas para disparar recursões infinitas e derrubar a aplicação.

Exemplo

Um parser XML ou JSON que processa estruturas aninhadas recursivamente: se o atacante envia um documento com milhares de níveis de aninhamento, cada chamada recursiva consome espaço da pilha até esgotar e derrubar o processo. Outro caso: função que processa árvores sem verificar profundidade máxima.

Como mitigar

Implemente limite explícito de profundidade (máximo de níveis de recursão) e valide entrada antes de processar. Use iteração (loop) em vez de recursão quando possível, ou monitore o consumo de pilha em tempo de execução com alertas de limite.

CVE-2022-23500MEDIUMTYPO3 subject to Uncontrolled Recursion resulting in Denial of ServiceEPSS 0.7%CVE-2024-12910MEDIUMDenial of Service in run-llama/llama_indexEPSS 0.7%CVE-2023-52079MEDIUMConversion of property names to strings can trigger infinite recursionEPSS 0.7%CVE-2026-93450HIGHgo-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and UnmarshalEPSS 0.7%CVE-2024-37973HIGHSecure Boot Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2026-65651HIGHtemporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversalEPSS 0.6%CVE-2026-41673HIGHxmldom: Denial of service via uncontrolled recursion in XML serializationEPSS 0.6%CVE-2024-44073HIGHThe Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.EPSS 0.6%CVE-2026-38970HIGHpdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursivEPSS 0.6%CVE-2026-44289HIGHprotobufjs: Denial of service through unbounded protobuf recursionEPSS 0.6%CVE-2026-45133HIGHSymfony: [Yaml] Harden the parser when handling untrusted inputEPSS 0.6%CVE-2025-68618MEDIUMMagick's failure to limit the depth of SVG file reads caused a DoS attack.EPSS 0.6%CVE-2025-70955HIGHA Stack Overflow vulnerability was discovered in the TON Virtual Machine (TVM) before v2024.10. The vulnerability stems from the improper haEPSS 0.6%CVE-2025-30193HIGHDenial of service via crafted TCP exchangeEPSS 0.6%CVE-2022-31628LOWphar wrapper can occur dos when using quine gzip fileEPSS 0.6%CVE-2026-29076MEDIUMcpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsingEPSS 0.6%CVE-2024-57699HIGHA security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large numberEPSS 0.6%CVE-2025-71382HIGHMuPDF < 1.27.0-rc1 Stack Exhaustion DoS via EPUB CSS RenderingEPSS 0.6%CVE-2023-29001HIGHUncontrolled recursion due to insufficient validation of the IPv6 source routing header in Contiki-NGEPSS 0.6%CVE-2026-32933HIGHAutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled RecursionEPSS 0.5%