Falhas do tipo CWE-674

458 resultados

Recursão descontrolada

Acontece quando uma função chama a si mesma (ou é chamada indiretamente por outra) sem limite adequado de profundidade, consumindo toda a memória da pilha (stack overflow). O atacante pode fornecer entrada malformada ou estruturas aninhadas excessivas para disparar recursões infinitas e derrubar a aplicação.

Exemplo

Um parser XML ou JSON que processa estruturas aninhadas recursivamente: se o atacante envia um documento com milhares de níveis de aninhamento, cada chamada recursiva consome espaço da pilha até esgotar e derrubar o processo. Outro caso: função que processa árvores sem verificar profundidade máxima.

Como mitigar

Implemente limite explícito de profundidade (máximo de níveis de recursão) e valide entrada antes de processar. Use iteração (loop) em vez de recursão quando possível, ou monitore o consumo de pilha em tempo de execução com alertas de limite.

CVE-2026-17177HIGHIBM Db2 Mirror for i is affected by multiple vulnerabilitiesEPSS 0.5%CVE-2026-12358HIGHSecurity vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.5%CVE-2026-67194HIGHCourier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH QueriesEPSS 0.5%CVE-2026-22260HIGHSuricata http1: infinite recursion in decompressionEPSS 0.5%CVE-2024-58264LOWThe serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.EPSS 0.5%CVE-2026-55588MEDIUMORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource ConsumptionEPSS 0.5%CVE-2026-67321MEDIUMaxios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypassEPSS 0.5%CVE-2026-88763MEDIUMSkupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of serviceEPSS 0.5%CVE-2026-73566HIGHnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionEPSS 0.5%CVE-2026-14803MEDIUMMojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoderEPSS 0.5%CVE-2026-52852MEDIUMTraccar: Uncontrolled Infinite Loop DoS via Group Parent CycleEPSS 0.5%CVE-2026-0989LOWLibxml2: unbounded relaxng include recursion leading to stack overflowEPSS 0.5%CVE-2026-59927MEDIUMMistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown filesEPSS 0.5%CVE-2026-102496HIGHApache XMLSchema: Denial of service through deeply nested schema structuresEPSS 0.5%CVE-2026-102497HIGHApache XMLSchema: Denial of service through cyclic schema definitions in the schema walkerEPSS 0.5%CVE-2026-102495HIGHApache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includesEPSS 0.5%CVE-2026-74792HIGHScriban before 7.0.0 Stack Overflow via nested array initializersEPSS 0.5%CVE-2026-40345HIGHdeepmerge-ts: Stack exhaustion when merging recursive object graphsEPSS 0.5%CVE-2026-54451HIGHElixir protobuf: Unbounded recursion depth in embedded-message decodingEPSS 0.5%CVE-2025-1752HIGHDenial of Service in run-llama/llama_indexEPSS 0.5%