cve.bz

CWE-674: Uncontrolled Recursion, page 9

Filter

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

What the weakness is: CWE-674 at MITRE

Ask an AI about CWE-674

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-674: Uncontrolled Recursion and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/674.html and https://cve.bz/cve/cwe/674?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2024-44073EPSS 0.6%

    The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.

  2. 2.1CVE-2024-7866EPSS 0.2%

    In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack overflow.

  3. 8.8CVE-2024-37973EPSS 0.6%

    Secure Boot Security Feature Bypass Vulnerability

  4. 7.5CVE-2024-5971EPSS 2.9%

    A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of t…

  5. 4.7CVE-2024-2965EPSS 0.3%

    A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mecha…

  6. 5.5CVE-2021-47465EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() In commit 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C") kvm_start_guest() became idle…

  7. 5.5CVE-2023-52761EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: riscv: VMAP_STACK overflow detection thread-safe commit 31da94c25aea ("riscv: add VMAP_STACK overflow detection") added support for CONFIG_VMAP_STACK. If overflow is det…

  8. 7.8CVE-2024-35886EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6_dump_done(). syzkaller reported infinite recursive calls of fib6_dump_done() during netlink socket destruction. [1] From the log, …

  9. 7.5CVE-2024-32609EPSS 0.8%

    HDF5 Library through 1.14.3 allows stack consumption in the function H5E_printf_stack in H5Eint.c.

  10. 5.5CVE-2024-4568EPSS 0.2%

    In Xpdf 4.05 (and earlier), a PDF object loop in the PDF resources leads to infinite recursion and a stack overflow.

  11. 7.5CVE-2024-4340EPSS 3.2%

    Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

  12. 5.5CVE-2024-3248EPSS 0.3%

    In Xpdf 4.05 (and earlier), a PDF object loop in the attachments leads to infinite recursion and a stack overflow.

  13. 5.5CVE-2024-3247EPSS 0.3%

    In Xpdf 4.05 (and earlier), a PDF object loop in an object stream leads to infinite recursion and a stack overflow.

  14. 9.8CVE-2023-51803EPSS 0.7%

    LinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "<?php ?>" substring.

  15. 7.5CVE-2024-29904EPSS 0.8%

    CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server. Upgrade to v4.4.7…

  16. 7.5CVE-2024-20311EPSS 0.8%

    A vulnerability in the Locator ID Separation Protocol (LISP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due to the…

  17. 6.5CVE-2024-28244EPSS 2.2%

    KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\def` or `\newcommand` that causes a near-infinite loop, despite setting `max…

  18. 6.5CVE-2024-28243EPSS 1.4%

    KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid…

  19. 7.5CVE-2024-25111EPSS 65%

    Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker…

  20. 5.3CVE-2024-1899EPSS 0.8%

    An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.

  21. 7.5CVE-2024-27454EPSS 1.2%

    orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.

  22. 5.0CVE-2024-25112EPSS 0.2%

    Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A denial-of-service was found in Exiv2 version v0.28.1: an unbounded recursion can cause Exiv2 to crash by exhaustin…

  23. 7.5CVE-2024-0210EPSS 0.5%

    Zigbee TLV dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file

  24. 6.5CVE-2023-52079EPSS 0.7%

    msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is avai…

  25. 7.5CVE-2023-50269EPSS 58%

    Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Re…

  26. 7.5CVE-2023-50262EPSS 1.5%

    Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One of the validations is that the SVG document does not reference itself. However, …

  27. 7.5CVE-2023-50251EPSS 0.9%

    php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the sys…

  28. 7.5CVE-2022-47374EPSS 0.7%

    A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions), SIMATIC S7-4…

  29. 7.5CVE-2023-49800EPSS 0.8%

    `nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on which options are available. We can abuse the retry logic to cause the server to …

  30. 7.5CVE-2023-47163EPSS 1.0%

    Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service (DoS) condition.

  31. 5.5CVE-2023-31794EPSS 0.3%

    MuPDF v1.21.1 was discovered to contain an infinite recursion in the component pdf_mark_list_push. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

  32. 7.5CVE-2023-4512EPSS 0.5%

    CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file

  33. 5.5CVE-2022-48545EPSS 0.2%

    An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02.

  34. 7.5CVE-2020-23804EPSS 1.2%

    Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.

  35. 7.5CVE-2023-36632EPSS 1.6%

    The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted…

  36. 7.5CVE-2023-2990EPSS 0.9%

    Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause infinite recursion and crash the service

  37. 7.5CVE-2023-31893EPSS 0.9%

    Telefnica Brasil Vivo Play (IPTV) Firmware: 2023.04.04.01.06.15 is vulnerable to Denial of Service (DoS) via DNS Recursion.

  38. 5.5CVE-2023-2664EPSS 0.3%

    In Xpdf 4.04 (and earlier), a PDF object loop in the embedded file tree leads to infinite recursion and a stack overflow.

  39. 5.5CVE-2023-2663EPSS 0.5%

    In Xpdf 4.04 (and earlier), a PDF object loop in the page label tree leads to infinite recursion and a stack overflow.

  40. 7.5CVE-2023-24472EPSS 1.3%

    A denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide malicious input to…

  41. 5.5CVE-2020-36691EPSS 0.2%

    An issue was discovered in the Linux kernel before 5.8. lib/nlattr.c allows attackers to cause a denial of service (unbounded recursion) via a nested Netlink policy with a back reference.

  42. 7.5CVE-2023-1436EPSS 1.0%

    An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown.

  43. 7.5CVE-2023-1370EPSS 1.1%

    [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code…

  44. 7.5CVE-2021-36395EPSS 0.7%

    In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.

  45. 5.3CVE-2022-37034EPSS 0.9%

    In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large file. If done repeatedly, this will result in Tomcat request-thread exhaustion and ultimately a denial …

  46. 7.5CVE-2023-22617EPSS 7.5%

    A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misconfigured domain, because QName minimization is used in QM fallback mode. This is fixed in 4.8.1.

  47. 5.5CVE-2022-47662EPSS 0.3%

    GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 has a segment fault (/stack overflow) due to infinite recursion in Media_GetSample isomedia/media.c:662

  48. 7.5CVE-2022-41966EPSS 9.3%

    XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed inpu…

  49. 7.5CVE-2022-23516EPSS 1.2%

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and…

  50. 7.5CVE-2022-23500EPSS 0.7%

    TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve c…