Falhas do tipo CWE-674

458 resultados

Recursão descontrolada

Acontece quando uma função chama a si mesma (ou é chamada indiretamente por outra) sem limite adequado de profundidade, consumindo toda a memória da pilha (stack overflow). O atacante pode fornecer entrada malformada ou estruturas aninhadas excessivas para disparar recursões infinitas e derrubar a aplicação.

Exemplo

Um parser XML ou JSON que processa estruturas aninhadas recursivamente: se o atacante envia um documento com milhares de níveis de aninhamento, cada chamada recursiva consome espaço da pilha até esgotar e derrubar o processo. Outro caso: função que processa árvores sem verificar profundidade máxima.

Como mitigar

Implemente limite explícito de profundidade (máximo de níveis de recursão) e valide entrada antes de processar. Use iteração (loop) em vez de recursão quando possível, ou monitore o consumo de pilha em tempo de execução com alertas de limite.

CVE-2024-12910MEDIUMDenial of Service in run-llama/llama_indexEPSS 0.7%CVE-2021-30470—A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call among PdfTokenizer::ReadArray(), PdfTokenizer::GetNextVariant() and PdfTokeEPSS 0.7%CVE-2023-52079MEDIUMConversion of property names to strings can trigger infinite recursionEPSS 0.7%CVE-2026-93435HIGHredis-parser through 3.0.0 Denial of Service via Unbounded RecursionEPSS 0.7%CVE-2026-81928HIGHNet::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG recordEPSS 0.7%CVE-2026-116011HIGHCrow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()EPSS 0.7%CVE-2025-70955HIGHA Stack Overflow vulnerability was discovered in the TON Virtual Machine (TVM) before v2024.10. The vulnerability stems from the improper haEPSS 0.7%CVE-2026-64194HIGHNet::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chainsEPSS 0.7%CVE-2024-53090HIGHafs: Fix lock recursionEPSS 0.7%CVE-2026-65651HIGHtemporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversalEPSS 0.7%CVE-2026-58178HIGHApache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgeryEPSS 0.7%CVE-2026-54425HIGHApache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update DecodingEPSS 0.7%CVE-2025-68618MEDIUMMagick's failure to limit the depth of SVG file reads caused a DoS attack.EPSS 0.6%CVE-2024-37973HIGHSecure Boot Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2026-41673HIGHxmldom: Denial of service via uncontrolled recursion in XML serializationEPSS 0.6%CVE-2024-44073HIGHThe Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.EPSS 0.6%CVE-2026-44289HIGHprotobufjs: Denial of service through unbounded protobuf recursionEPSS 0.6%CVE-2026-45133HIGHSymfony: [Yaml] Harden the parser when handling untrusted inputEPSS 0.6%CVE-2026-38970HIGHpdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursivEPSS 0.6%CVE-2026-53752HIGHdocx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of ServiceEPSS 0.6%