CWE-674: Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Also known as Stack Exhaustion.
A kind of CWE-834 Excessive Iteration.
From the CWE List. © The MITRE Corporation.
Newest
- tootallnate plist.js plist.js before 5.0.1 Uncontrolled Resource Consumption via Binary Parser 8.7 High
- circl vulnerability-lookup Vulnerability-Lookup: memory amplification through webhook payload template format specifiers 5.3 Medium
- the document foundation libreoffice Heap buffer overflow in dBASE index import 5.4 Medium
- jopenlibs vault-java-driver vault-java-driver: stored deeply nested JSON kills every thread that reads it 6.5 Medium
- google chrome Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker... 8.8 High
- isomorphic-git isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS) 4.3 Medium
- elastic elasticsearch Uncontrolled Recursion in Elasticsearch Leading to Denial of Service 7.5 High
- surrealdb SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization 7.1 High
- hdfgroup hdf5 Uncontrolled Recursion in HDF5 H5B__iterate_helper() via Crafted File 4.3 Medium
- huawei harmonyos DoS vulnerability in the file parsing module. Impact: Successful exploitation of this... 4.3 Medium
- apache software foundation thrift Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default 8.2 High
-
github.com/anacrolix/torrentGo anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS 6.5 Medium - pistacheio pistache Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs) 5.9 Medium
- axigen mail server Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests 8.7 High
- red hat build of apache camel 4 for quarkus 3, data grid 8, fuse 7 +2 more +4 more Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror 4.3 Medium
- espressif esp-protocols espressif/mdns has Uncontrolled Recursion in mDNS Name Decompression 6.5 Medium
- sqlite SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause 6.8 Medium
- sqlite SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain 6.8 Medium
- sqlite SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander() 6.8 Medium
- digitalbazaar forge Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer 7.5 High
- rgrove crass Crass: A large number of adjacent CSS comments can trigger a SystemStackError 6.3 Medium
- rgrove crass Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage 6.3 Medium
- imagemagick ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder 6.3 Medium
- apache software foundation qpid proton c Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash 9.8 Critical
- grafana oss, enterprise +1 more Server-side expression parser denial of service 6.5 Medium
- progress software telerik document processing libraries Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing 7.5 High
- progress software telerik document processing libraries Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering 7.5 High
- progress software telerik document processing libraries Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing 7.5 High
-
msgpackUbuntu An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() component of rybakit... 7.5 High - tanium endpoint configuration toolset solution, threat-response-cx +1 more Tanium addressed an infinite loop vulnerability in Threat Response Client Extension. 3.3 Low
- semantic-mediawiki semantic mediawiki, semanticmediawiki +1 more Semantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:Ask 8.7 High
- go-jose Go JOSE: Panics in JSON parsing 6.9 Medium
- appsup-dart jose Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types 5.9 Medium
- imagemagick ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder 4.8 Medium
- crowcpp crow Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load() 8.7 High
- rthalley dnspython dnspython dns.name.from_wire_parser() excessive CPU use 7.5 High
- silabs emberznet Authenticated Denial-of-Service in Zigbee Publish Billing Period 6.0 Medium
- vaadin android-json Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json 6.3 Medium
- apache software foundation brpc Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser 7.5 High
- apache software foundation brpc Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser 7.5 High
- apache software foundation brpc Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser 7.5 High
- apache software foundation brpc Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding 7.5 High
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +4 more +6 more Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml 6.2 Medium
- apostrophecms apostrophe, sanitize-html +1 more ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) 5.3 Medium
- rgrove crass Crass: Large numeric exponents cause CPU and memory denial of service 8.9 High
- python pillow Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310) 8.7 High
-
libcpanel-json-xs-perlDebian,perl-Cpanel-JSON-XSAzure Linux +1 more Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag 7.5 High - mongodb inc. php driver Unbounded Recursion in phongo_bson_visit_document/visit_array: 8.2 High
- qt Denial-of-service vulnerability in the SVG parser and renderer impacts Qt 7.1 High
- fleetdm fleet Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing 8.7 High
- Show olderLoading…