CWE-674: Uncontrolled Recursion, page 10

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

What the weakness is: CWE-674 at MITRE

1. 7.5CVE-2022-41881EPSS 1.6%2022-12-12

   Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched…

2. 7.5CVE-2022-46405EPSS 1.0%2022-12-04

   Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that t…

3. 6.5CVE-2022-42321EPSS 0.3%2022-11-01

   Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some Xenstore operations (e.g. for deleting a sub-tree of Xenstore nodes). With sufficiently deep nesting levels this can result in stack exhaus…

4. 7.5CVE-2022-27810EPSS 0.9%2022-10-06

   It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was only possible to trigger in dev-mode (when asserts were enabled). This issue af…

5. 5.5CVE-2022-31628EPSS 0.6%2022-09-28

   In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

6. 4.4CVE-2022-28201EPSS 0.4%2022-09-19

   An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinite recursion, because a bare local interwiki is mishandled for the mainpage messa…

7. 7.5CVE-2022-40150EPSS 1.6%2022-09-16

   Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory…

8. 5.5CVE-2022-38334EPSS 0.4%2022-09-15

   XPDF v4.04 and earlier was discovered to contain a stack overflow via the function Catalog::countPageTree() at Catalog.cc.

9. 5.5CVE-2022-3222EPSS 0.8%2022-09-15

   Uncontrolled Recursion in GitHub repository gpac/gpac prior to 2.1.0-DEV.

10. 8.8CVE-2022-3216EPSS 0.6%2022-09-14

    A vulnerability has been found in Nintendo Game Boy Color and classified as problematic. This vulnerability affects unknown code of the component Mobile Adapter GB. The manipulation leads to memory corruption. The attack can be initiated r…

11. 5.5CVE-2021-3997EPSS 1.7%2022-08-23

    A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.

12. 7.5CVE-2022-23460EPSS 0.7%2022-08-19

    Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustion in an address sanitized (ASAN) build. This issue may lead to Denial of Service if the program usi…

13. 6.7CVE-2022-20382EPSS 0.1%2022-08-11

    In (TBD) of (TBD), there is a possible out of bounds write due to kernel stack overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: And…

14. 7.5CVE-2022-30635EPSS 1.9%2022-08-10

    Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

15. 7.5CVE-2022-30633EPSS 2.2%2022-08-10

    Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any'…

16. 7.5CVE-2022-30632EPSS 2.2%2022-08-10

    Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

17. 7.5CVE-2022-30631EPSS 2.2%2022-08-10

    Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

18. 7.5CVE-2022-30630EPSS 2.2%2022-08-10

    Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

19. 7.5CVE-2022-28131EPSS 2.6%2022-08-10

    Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

20. 5.5CVE-2022-1962EPSS 0.9%2022-08-10

    Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

21. 7.5CVE-2022-37315EPSS 1.2%2022-08-01

    graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser.

22. 7.5CVE-2022-31173EPSS 1.7%2022-08-01

    Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue has been addressed in version 0.15.10. Users are advised to upgrade. Users unable …

23. 8.3CVE-2019-10761EPSS 1.3%2022-07-13

    This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to…

24. 6.5CVE-2022-31052EPSS 1.7%2022-06-28

    Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is …

25. 6.5CVE-2022-31099EPSS 1.0%2022-06-27

    rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of n…

26. 7.5CVE-2022-31019EPSS 1.7%2022-06-09

    Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with the following request: `curl -d "array[_0][0][array][_0][0][array]$(for f in $(…

27. 5.5CVE-2022-1771EPSS 1.2%2022-05-18

    Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975.

28. 5.5CVE-2022-30974EPSS 1.2%2022-05-18

    compile in regexp.c in Artifex MuJS through 1.2.0 results in stack consumption because of unlimited recursion, a different issue than CVE-2019-11413.

29. 7.5CVE-2022-24675EPSS 10.0%2022-04-20

    encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.

30. 7.5CVE-2022-28773EPSS 1.5%2022-04-12

    Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can be restarted automatically.

31. 7.5CVE-2022-23974EPSS 2.1%2022-04-05

    In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exp…

32. 9.8CVE-2021-41752EPSS 1.2%2022-04-05

    Stack overflow vulnerability in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021 due to an unbounded recursive call to the new opt() function.

33. 5.5CVE-2022-27943EPSS 1.0%2022-03-26

    libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

34. 7.5CVE-2022-24921EPSS 3.2%2022-03-05

    regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

35. 6.5CVE-2022-23606EPSS 1.0%2022-02-22

    Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursi…

36. 6.5CVE-2022-25313EPSS 3.3%2022-02-18

    In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

37. 7.5CVE-2022-23591EPSS 0.8%2022-02-04

    Tensorflow is an Open Source Machine Learning Framework. The `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a `GraphDef` containing a fragment such as…

38. 5.3CVE-2022-23889EPSS 1.1%2022-01-28

    The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments.

39. 7.8CVE-2021-46509EPSS 0.7%2022-01-27

    Cesanta MJS v2.20.0 was discovered to contain a stack overflow via snquote at mjs/src/mjs_json.c.

40. 5.5CVE-2021-46507EPSS 0.6%2022-01-27

    Jsish v3.5.0 was discovered to contain a stack overflow via Jsi_LogMsg at src/jsiUtils.c.

41. 5.5CVE-2021-46505EPSS 0.6%2022-01-27

    Jsish v3.5.0 was discovered to contain a stack overflow via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x5b1e5.

42. 6.5CVE-2022-21708EPSS 1.2%2022-01-21

    graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause s…

43. 5.5CVE-2021-46195EPSS 0.8%2022-01-14

    GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.

44. 5.5CVE-2021-45832EPSS 0.8%2022-01-05

    A Stack-based Buffer Overflow Vulnerability exists in HDF5 1.13.1-1 at at hdf5/src/H5Eint.c, which causes a Denial of Service (context-dependent).

45. 5.9CVE-2021-45105EPSS >99.9%2021-12-18

    Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of…

46. 7.5CVE-2021-42717EPSS 3.2%2021-12-07

    ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 3…

47. 7.5CVE-2021-39929EPSS 3.8%2021-11-19

    Uncontrolled Recursion in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file

48. 7.5CVE-2021-43172EPSS 1.1%2021-11-09

    NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. In RPKI, a CA can choose the RRDP repository it wishes to publish its data in. By continuo…

49. 5.5CVE-2021-43519EPSS 1.2%2021-11-09

    Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.

50. 7.5CVE-2021-42697ExploitEPSS 36%2021-11-02

    Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comm…