Falhas do tipo CWE-674

458 resultados

Recursão descontrolada

Acontece quando uma função chama a si mesma (ou é chamada indiretamente por outra) sem limite adequado de profundidade, consumindo toda a memória da pilha (stack overflow). O atacante pode fornecer entrada malformada ou estruturas aninhadas excessivas para disparar recursões infinitas e derrubar a aplicação.

Exemplo

Um parser XML ou JSON que processa estruturas aninhadas recursivamente: se o atacante envia um documento com milhares de níveis de aninhamento, cada chamada recursiva consome espaço da pilha até esgotar e derrubar o processo. Outro caso: função que processa árvores sem verificar profundidade máxima.

Como mitigar

Implemente limite explícito de profundidade (máximo de níveis de recursão) e valide entrada antes de processar. Use iteração (loop) em vez de recursão quando possível, ou monitore o consumo de pilha em tempo de execução com alertas de limite.

CVE-2026-67552HIGHApache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authentication stackoverflowEPSS 0.8%CVE-2026-42039MEDIUMAxios: unbounded recursion in toFormData causes DoS via deeply nested request dataEPSS 0.8%CVE-2026-15996MEDIUMDenial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parametersEPSS 0.8%CVE-2026-91863HIGHApache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of serviceEPSS 0.8%CVE-2026-54297HIGHFaraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parametersEPSS 0.8%CVE-2026-49451HIGHMicrosoft.OpenAPI: Circular schema references may terminate OpenAPI parsingEPSS 0.7%CVE-2021-36395HIGHIn Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.EPSS 0.7%CVE-2024-47831MEDIUMNext.js image optimization has Denial of Service conditionEPSS 0.7%CVE-2022-23500MEDIUMTYPO3 subject to Uncontrolled Recursion resulting in Denial of ServiceEPSS 0.7%CVE-2025-9624HIGHOpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoSEPSS 0.7%CVE-2021-30471—A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call in PdfNamesTree::AddToDictionary function in src/podofo/doc/PdfNamesTree.cpEPSS 0.7%CVE-2026-69220HIGHRabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoSEPSS 0.7%CVE-2026-17501MEDIUMggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursionEPSS 0.7%CVE-2022-47374HIGHA vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400EPSS 0.7%CVE-2026-4224MEDIUMStack overflow parsing XML with deeply nested DTD content modelsEPSS 0.7%CVE-2026-0994HIGHDenial of Service in Python ProtobufEPSS 0.7%CVE-2023-51803CRITICALLinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "<?php ?>" substring.EPSS 0.7%CVE-2026-67215HIGHcJSON JSON Patch copy/add Uncontrolled Recursion Stack ExhaustionEPSS 0.7%CVE-2026-63462HIGHUnleash: Unauthenticated single-request DoS via OpenAPI validation error formatterEPSS 0.7%CVE-2026-29076MEDIUMcpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsingEPSS 0.7%