Common Weakness Enumeration
CWE-674
Allowed-with-ReviewUncontrolled Recursion
Abstraction: Class · Status: Draft
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
615 vulnerabilities reference this CWE, most recent first.
GHSA-R8RM-4HFJ-2X87
Vulnerability from github – Published: 2022-02-10 20:23 – Updated: 2021-04-22 16:58
VLAI
Summary
Data Amplification in Play Framework
Details
In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.typesafe.play:play"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.7.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.typesafe.play:play"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-26882"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-22T16:58:02Z",
"nvd_published_at": "2020-11-06T14:15:00Z",
"severity": "HIGH"
},
"details": "In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input.",
"id": "GHSA-r8rm-4hfj-2x87",
"modified": "2021-04-22T16:58:02Z",
"published": "2022-02-10T20:23:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26882"
},
{
"type": "WEB",
"url": "https://github.com/playframework/playframework/pull/10495"
},
{
"type": "WEB",
"url": "https://www.playframework.com/security/vulnerability/CVE-2020-26882-JsonParseDataAmplification"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Data Amplification in Play Framework"
}
GHSA-R9VW-MPPF-3883
Vulnerability from github – Published: 2022-08-11 00:00 – Updated: 2026-03-06 18:31
VLAI
Details
Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-30633"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-10T20:15:00Z",
"severity": "HIGH"
},
"details": "Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the \u0027any\u0027 field tag.",
"id": "GHSA-r9vw-mppf-3883",
"modified": "2026-03-06T18:31:09Z",
"published": "2022-08-11T00:00:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30633"
},
{
"type": "WEB",
"url": "https://go.dev/cl/417061"
},
{
"type": "WEB",
"url": "https://go.dev/issue/53611"
},
{
"type": "WEB",
"url": "https://go.googlesource.com/go/+/c4c1993fd2a5b26fe45c09592af6d3388a3b2e08"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-0523"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RCR6-G7JC-F57G
Vulnerability from github – Published: 2026-05-18 20:37 – Updated: 2026-06-11 14:06
VLAI
Summary
ImageMagick: Stack overflow in fx operation
Details
Due to a missing depth check a stack overflow can occur in the fx operation by passing a crafted argument.
Severity
6.2 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-AnyCPU"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-HDRI-AnyCPU"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-HDRI-OpenMP-arm64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-HDRI-OpenMP-x64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-HDRI-arm64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-HDRI-x64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-HDRI-x86"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-OpenMP-arm64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-OpenMP-x64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-arm64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-x64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-x86"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q8-AnyCPU"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q8-OpenMP-arm64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q8-OpenMP-x64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q8-arm64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q8-x64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q8-x86"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.13.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-46557"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-18T20:37:31Z",
"nvd_published_at": "2026-06-10T23:16:47Z",
"severity": "MODERATE"
},
"details": "Due to a missing depth check a stack overflow can occur in the fx operation by passing a crafted argument.",
"id": "GHSA-rcr6-g7jc-f57g",
"modified": "2026-06-11T14:06:07Z",
"published": "2026-05-18T20:37:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rcr6-g7jc-f57g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46557"
},
{
"type": "PACKAGE",
"url": "https://github.com/ImageMagick/ImageMagick"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "ImageMagick: Stack overflow in fx operation"
}
GHSA-RF5R-VG7Q-HGM6
Vulnerability from github – Published: 2022-05-13 01:18 – Updated: 2022-05-13 01:18
VLAI
Details
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-1158"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-23T19:29:00Z",
"severity": "MODERATE"
},
"details": "Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON.",
"id": "GHSA-rf5r-vg7q-hgm6",
"modified": "2022-05-13T01:18:56Z",
"published": "2022-05-13T01:18:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1158"
},
{
"type": "WEB",
"url": "https://mikrotik.com/download/changelogs"
},
{
"type": "WEB",
"url": "https://mikrotik.com/download/changelogs/bugfix-release-tree"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2018-21"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2019/Jul/20"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RF62-M3FM-W623
Vulnerability from github – Published: 2022-05-17 03:54 – Updated: 2022-05-17 03:54
VLAI
Details
Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2016-4425"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-05-17T14:08:00Z",
"severity": "HIGH"
},
"details": "Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.",
"id": "GHSA-rf62-m3fm-w623",
"modified": "2022-05-17T03:54:54Z",
"published": "2022-05-17T03:54:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4425"
},
{
"type": "WEB",
"url": "https://github.com/akheron/jansson/issues/282"
},
{
"type": "WEB",
"url": "https://github.com/akheron/jansson/pull/284"
},
{
"type": "WEB",
"url": "https://github.com/akheron/jansson/pull/284/commits/64ce0ad3731ebd77e02897b07920eadd0e2cc318"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2015/dsa-3577"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/05/01/5"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/05/02/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/05/03/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RF74-V2FM-23PW
Vulnerability from github – Published: 2026-03-18 20:17 – Updated: 2026-03-18 20:17
VLAI
Summary
Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS
Details
Summary
JSONTaggedDecoder.decode_obj() in nltk/jsontags.py calls itself
recursively without any depth limit. A deeply nested JSON structure
exceeding sys.getrecursionlimit() (default: 1000) will raise an
unhandled RecursionError, crashing the Python process.
Affected code
File: nltk/jsontags.py, lines 47–52
@classmethod
def decode_obj(cls, obj):
if isinstance(obj, dict):
obj = {key: cls.decode_obj(val) for (key, val) in obj.items()}
elif isinstance(obj, list):
obj = list(cls.decode_obj(val) for val in obj)
Proof of Concept
import sys, json
from nltk.jsontags import JSONTaggedDecoder
depth = sys.getrecursionlimit() + 50 # e.g. 1050
payload = '{"x":' * depth + "null" + "}" * depth
# Raises RecursionError, crashing the process
json.loads(payload, cls=JSONTaggedDecoder)
Impact
Any code path that passes externally-supplied JSON to
JSONTaggedDecoder is vulnerable to denial of service.
The severity depends on whether such a path exists in the
calling code (e.g. nltk/data.py).
Suggested Fix
Add a depth parameter with a hard limit:
@classmethod
def decode_obj(cls, obj, _depth=0):
if _depth > 100:
raise ValueError("JSON nesting too deep")
if isinstance(obj, dict):
obj = {key: cls.decode_obj(val, _depth + 1)
for (key, val) in obj.items()}
elif isinstance(obj, list):
obj = list(cls.decode_obj(val, _depth + 1) for val in obj)
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "nltk"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.9.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-18T20:17:43Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n`JSONTaggedDecoder.decode_obj()` in `nltk/jsontags.py` calls itself \nrecursively without any depth limit. A deeply nested JSON structure \nexceeding `sys.getrecursionlimit()` (default: 1000) will raise an \nunhandled `RecursionError`, crashing the Python process.\n\n### Affected code\nFile: `nltk/jsontags.py`, lines 47\u201352\n```python\n@classmethod\ndef decode_obj(cls, obj):\n if isinstance(obj, dict):\n obj = {key: cls.decode_obj(val) for (key, val) in obj.items()}\n elif isinstance(obj, list):\n obj = list(cls.decode_obj(val) for val in obj)\n```\n\n### Proof of Concept\n```python\nimport sys, json\nfrom nltk.jsontags import JSONTaggedDecoder\n\ndepth = sys.getrecursionlimit() + 50 # e.g. 1050\npayload = \u0027{\"x\":\u0027 * depth + \"null\" + \"}\" * depth\n\n# Raises RecursionError, crashing the process\njson.loads(payload, cls=JSONTaggedDecoder)\n```\n\n### Impact\nAny code path that passes externally-supplied JSON to \n`JSONTaggedDecoder` is vulnerable to denial of service.\nThe severity depends on whether such a path exists in the \ncalling code (e.g. `nltk/data.py`).\n\n### Suggested Fix\nAdd a depth parameter with a hard limit:\n```python\n@classmethod\ndef decode_obj(cls, obj, _depth=0):\n if _depth \u003e 100:\n raise ValueError(\"JSON nesting too deep\")\n if isinstance(obj, dict):\n obj = {key: cls.decode_obj(val, _depth + 1) \n for (key, val) in obj.items()}\n elif isinstance(obj, list):\n obj = list(cls.decode_obj(val, _depth + 1) for val in obj)\n```",
"id": "GHSA-rf74-v2fm-23pw",
"modified": "2026-03-18T20:17:43Z",
"published": "2026-03-18T20:17:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-rf74-v2fm-23pw"
},
{
"type": "PACKAGE",
"url": "https://github.com/nltk/nltk"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS"
}
GHSA-RMJ6-CH86-HM24
Vulnerability from github – Published: 2026-05-19 09:31 – Updated: 2026-05-19 09:31
VLAI
Details
Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation.
This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-47317"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-19T08:16:16Z",
"severity": "MODERATE"
},
"details": "Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Excessive Allocation.\n\nThis issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.",
"id": "GHSA-rmj6-ch86-hm24",
"modified": "2026-05-19T09:31:20Z",
"published": "2026-05-19T09:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47317"
},
{
"type": "WEB",
"url": "https://github.com/Samsung/escargot/pull/1565"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RMMF-6VG8-65GC
Vulnerability from github – Published: 2022-09-15 00:00 – Updated: 2022-09-18 00:00
VLAI
Details
A vulnerability has been found in Nintendo Game Boy Color and classified as problematic. This vulnerability affects unknown code of the component Mobile Adapter GB. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-208606 is the identifier assigned to this vulnerability.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-3216"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-14T20:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability has been found in Nintendo Game Boy Color and classified as problematic. This vulnerability affects unknown code of the component Mobile Adapter GB. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-208606 is the identifier assigned to this vulnerability.",
"id": "GHSA-rmmf-6vg8-65gc",
"modified": "2022-09-18T00:00:31Z",
"published": "2022-09-15T00:00:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3216"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.208606"
},
{
"type": "WEB",
"url": "https://xcellerator.github.io/posts/tetsuji"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RMMH-P597-PPVV
Vulnerability from github – Published: 2024-02-26 21:31 – Updated: 2026-04-24 20:36
VLAI
Summary
Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing
Details
Showdownjs, versions <= 2.1.0, anchors subparser used to parse links has a nested regular expression which can lead to denial of service conditions given malicious input.
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "showdown"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-1899"
],
"database_specific": {
"cwe_ids": [
"CWE-674",
"CWE-777"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-24T20:36:01Z",
"nvd_published_at": "2024-02-26T19:15:07Z",
"severity": "MODERATE"
},
"details": "Showdownjs, versions \u003c= 2.1.0, `anchors` subparser used to parse links has a nested regular expression which can lead to denial of service conditions given malicious input.",
"id": "GHSA-rmmh-p597-ppvv",
"modified": "2026-04-24T20:36:01Z",
"published": "2024-02-26T21:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1899"
},
{
"type": "PACKAGE",
"url": "https://github.com/showdownjs/showdown"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2024-05"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing"
}
GHSA-RV9V-R4VM-GJ8X
Vulnerability from github – Published: 2024-08-19 03:30 – Updated: 2024-09-09 18:20
VLAI
Summary
Miniscript allows stack consumption
Details
The Miniscript (aka rust-miniscript) library for Rust allows stack consumption because it does not properly track tree depth.
Severity
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "miniscript"
},
"ranges": [
{
"events": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.2.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "miniscript"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.2.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "miniscript"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.2.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "miniscript"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-44073"
],
"database_specific": {
"cwe_ids": [
"CWE-674",
"CWE-770",
"CWE-787"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-19T18:25:09Z",
"nvd_published_at": "2024-08-19T03:15:03Z",
"severity": "MODERATE"
},
"details": "The Miniscript (aka rust-miniscript) library for Rust allows stack consumption because it does not properly track tree depth.",
"id": "GHSA-rv9v-r4vm-gj8x",
"modified": "2024-09-09T18:20:53Z",
"published": "2024-08-19T03:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44073"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/704"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/712"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/712/files"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/713/files"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/714/files"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/715/files"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/commit/5b0f5e3417f027a22b066debf825dbe6644b575b"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/commit/8f54b5e3fb7129ed9fbed53f1cb9e6e62ea4c151"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Miniscript allows stack consumption"
}
Mitigation
Implementation
Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
Mitigation
Implementation
Increase the stack size.
CAPEC-230: Serialized Data with Nested Payloads
Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization.
CAPEC-231: Oversized Serialized Data Payloads
An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.