CWE-674
Allowed-with-ReviewUncontrolled Recursion
Abstraction: Class · Status: Draft
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
755 vulnerabilities reference this CWE, most recent first.
GHSA-HMPX-QPGP-FW83
Vulnerability from github – Published: 2026-07-19 12:30 – Updated: 2026-07-20 15:31In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix dead ACL conflict guard in nfsd4_create
nfsd4_create() steals create->cr_dpacl/cr_pacl into the local nfsd_attrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard tests the already-nilled source fields, making it permanently dead code:
if (create->cr_acl) {
if (create->cr_dpacl || create->cr_pacl) /* always false */
When a client encodes both FATTR4_WORD0_ACL and FATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL in the same CREATE fattr bitmap, nfsd4_acl_to_attr() overwrites attrs.na_pacl/na_dpacl without releasing the originals, leaking two posix_acl slab objects per request. Repeated requests cause unbounded slab exhaustion.
Fix by checking attrs.na_dpacl/na_pacl (the stolen values) instead of the nilled create->cr_dpacl/cr_pacl, matching the correct pattern already used in nfsd4_setattr().
{
"affected": [],
"aliases": [
"CVE-2026-53395"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-19T12:16:50Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix dead ACL conflict guard in nfsd4_create\n\nnfsd4_create() steals create-\u003ecr_dpacl/cr_pacl into the local\nnfsd_attrs via the designated initializer, then immediately sets the\nsource pointers to NULL. The subsequent conflict guard tests the\nalready-nilled source fields, making it permanently dead code:\n\n if (create-\u003ecr_acl) {\n if (create-\u003ecr_dpacl || create-\u003ecr_pacl) /* always false */\n\nWhen a client encodes both FATTR4_WORD0_ACL and\nFATTR4_WORD2_POSIX_{DEFAULT,ACCESS}_ACL in the same CREATE fattr\nbitmap, nfsd4_acl_to_attr() overwrites attrs.na_pacl/na_dpacl without\nreleasing the originals, leaking two posix_acl slab objects per\nrequest. Repeated requests cause unbounded slab exhaustion.\n\nFix by checking attrs.na_dpacl/na_pacl (the stolen values) instead of\nthe nilled create-\u003ecr_dpacl/cr_pacl, matching the correct pattern\nalready used in nfsd4_setattr().",
"id": "GHSA-hmpx-qpgp-fw83",
"modified": "2026-07-20T15:31:45Z",
"published": "2026-07-19T12:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53395"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8371cc5c0a2cc2a71b3dcfd47ff1f7fcfc526a5e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a60f25a800846ab8e5a13f8a9d05111f2aee55a7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HPWF-8G29-85QM
Vulnerability from github – Published: 2026-04-14 00:15 – Updated: 2026-04-27 16:16Impact
Attacker sends many small, valid JSON messages in one TCP frame → handleData() recurses once per message; buffer shrinks each call → maxBufferSize is never reached; call stack overflows instead → A ~47 KB payload is sufficient to trigger RangeError
Patches
Fixed in @nestjs/microservices@11.1.19
References
Discovered by https://github.com/hwpark6804-gif
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 11.1.18"
},
"package": {
"ecosystem": "npm",
"name": "@nestjs/microservices"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "11.1.19"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40879"
],
"database_specific": {
"cwe_ids": [
"CWE-674",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-14T00:15:09Z",
"nvd_published_at": "2026-04-21T20:17:01Z",
"severity": "HIGH"
},
"details": "### Impact\nAttacker sends many small, valid JSON messages in one TCP frame\n \u2192 handleData() recurses once per message; buffer shrinks each call\n \u2192 maxBufferSize is never reached; call stack overflows instead\n \u2192 A ~47 KB payload is sufficient to trigger RangeError\n\n### Patches\n\nFixed in `@nestjs/microservices@11.1.19`\n\n### References\n\nDiscovered by https://github.com/hwpark6804-gif",
"id": "GHSA-hpwf-8g29-85qm",
"modified": "2026-04-27T16:16:57Z",
"published": "2026-04-14T00:15:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nestjs/nest/security/advisories/GHSA-hpwf-8g29-85qm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40879"
},
{
"type": "PACKAGE",
"url": "https://github.com/nestjs/nest"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)"
}
GHSA-HQ75-PVPQ-98XX
Vulnerability from github – Published: 2022-04-13 00:00 – Updated: 2022-04-21 00:00Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can be restarted automatically.
{
"affected": [],
"aliases": [
"CVE-2022-28773"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-674",
"CWE-789"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-12T17:15:00Z",
"severity": "HIGH"
},
"details": "Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can be restarted automatically.",
"id": "GHSA-hq75-pvpq-98xx",
"modified": "2022-04-21T00:00:52Z",
"published": "2022-04-13T00:00:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28773"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/3111293"
},
{
"type": "WEB",
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HQQH-CQXQ-WQR6
Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-06-29 00:00Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an stack exhaustion vulnerability in the /nova/bin/net process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.
{
"affected": [],
"aliases": [
"CVE-2020-20213"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-07T14:15:00Z",
"severity": "MODERATE"
},
"details": "Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an stack exhaustion vulnerability in the /nova/bin/net process. An authenticated remote attacker can cause a Denial of Service due to overloading the systems CPU.",
"id": "GHSA-hqqh-cqxq-wqr6",
"modified": "2022-06-29T00:00:30Z",
"published": "2022-05-24T19:07:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-20213"
},
{
"type": "WEB",
"url": "https://cwe.mitre.org/data/definitions/674.html"
},
{
"type": "WEB",
"url": "https://mikrotik.com"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/May/10"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HRQM-VF6V-J4GP
Vulnerability from github – Published: 2025-02-20 03:32 – Updated: 2025-02-20 03:32Bundle Protocol and CBOR dissector crashes in Wireshark 4.4.0 to 4.4.3 and 4.2.0 to 4.2.10 allows denial of service via packet injection or crafted capture file
{
"affected": [],
"aliases": [
"CVE-2025-1492"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-20T02:15:38Z",
"severity": "HIGH"
},
"details": "Bundle Protocol and CBOR dissector crashes in Wireshark 4.4.0 to 4.4.3 and 4.2.0 to 4.2.10 allows denial of service via packet injection or crafted capture file",
"id": "GHSA-hrqm-vf6v-j4gp",
"modified": "2025-02-20T03:32:03Z",
"published": "2025-02-20T03:32:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1492"
},
{
"type": "WEB",
"url": "https://gitlab.com/wireshark/wireshark/-/issues/20373"
},
{
"type": "WEB",
"url": "https://www.wireshark.org/security/wnpa-sec-2025-01.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HV87-47H9-JCVQ
Vulnerability from github – Published: 2021-08-25 20:43 – Updated: 2023-06-13 22:23Affected versions of this crate did not prevent deep recursion while deserializing data structures. This allows an attacker to make a YAML file with deeply nested structures that causes an abort while deserializing it. The flaw was corrected by checking the recursion depth.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "yaml-rust"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-20993"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-19T21:24:44Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Affected versions of this crate did not prevent deep recursion while deserializing data structures. This allows an attacker to make a YAML file with deeply nested structures that causes an abort while deserializing it. The flaw was corrected by checking the recursion depth.",
"id": "GHSA-hv87-47h9-jcvq",
"modified": "2023-06-13T22:23:08Z",
"published": "2021-08-25T20:43:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20993"
},
{
"type": "WEB",
"url": "https://github.com/chyh1990/yaml-rust/pull/109"
},
{
"type": "WEB",
"url": "https://github.com/chyh1990/yaml-rust/commit/d61b49cb90391fc4f7f72a1abe597476c8651a07"
},
{
"type": "PACKAGE",
"url": "https://github.com/chyh1990/yaml-rust"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2018-0006.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Uncontrolled recursion in rust-yaml"
}
GHSA-HV8P-7QGV-7R4P
Vulnerability from github – Published: 2026-01-31 00:30 – Updated: 2026-01-31 00:30IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service using a specially crafted SQL statement including XML that performs uncontrolled recursion.
{
"affected": [],
"aliases": [
"CVE-2025-36001"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-30T22:15:53Z",
"severity": "MODERATE"
},
"details": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service using a specially crafted SQL statement including XML that performs uncontrolled recursion.",
"id": "GHSA-hv8p-7qgv-7r4p",
"modified": "2026-01-31T00:30:28Z",
"published": "2026-01-31T00:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36001"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7257616"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HVQ2-WF92-J4F3
Vulnerability from github – Published: 2025-09-26 14:38 – Updated: 2025-09-26 14:38Security Advisory: express-xss-sanitizer
Overview
A vulnerability was discovered in express-xss-sanitizer that allowed unbounded recursion depth during sanitization of nested objects.
Affected Versions
- All versions prior to 2.0.1
Patched Versions
- 2.0.1 and later
Description
The sanitize function in lib/sanitize.js performed recursive sanitization without depth limiting, making it vulnerable to stack overflow attacks via specially crafted deeply nested JSON objects.
Impact
An attacker could cause denial-of-service by sending a request with deeply nested structures, potentially crashing the Node.js process.
Solution
Upgrade to version 2.0.1 or later:
npm install express-xss-sanitizer@latest
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "express-xss-sanitizer"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-59364"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-26T14:38:13Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "# Security Advisory: express-xss-sanitizer\n\n## Overview\nA vulnerability was discovered in express-xss-sanitizer that allowed unbounded recursion depth during sanitization of nested objects.\n\n## Affected Versions\n- All versions prior to 2.0.1\n\n## Patched Versions\n- 2.0.1 and later\n\n## Description\nThe sanitize function in lib/sanitize.js performed recursive sanitization without depth limiting, making it vulnerable to stack overflow attacks via specially crafted deeply nested JSON objects.\n\n## Impact\nAn attacker could cause denial-of-service by sending a request with deeply nested structures, potentially crashing the Node.js process.\n\n## Solution\nUpgrade to version 2.0.1 or later:\n\n```bash\nnpm install express-xss-sanitizer@latest\n```",
"id": "GHSA-hvq2-wf92-j4f3",
"modified": "2025-09-26T14:38:14Z",
"published": "2025-09-26T14:38:13Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/AhmedAdelFahim/express-xss-sanitizer/security/advisories/GHSA-hvq2-wf92-j4f3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59364"
},
{
"type": "WEB",
"url": "https://github.com/AhmedAdelFahim/express-xss-sanitizer/pull/23"
},
{
"type": "WEB",
"url": "https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/62d6542a2a57298da7a2e02de623454007e4f6d6"
},
{
"type": "WEB",
"url": "https://dbugs.ptsecurity.com/vulnerability/PT-2025-37434"
},
{
"type": "WEB",
"url": "https://gist.github.com/Spendroslav/177804eaef5acfb222a550de212a1b94"
},
{
"type": "PACKAGE",
"url": "https://github.com/AhmedAdelFahim/express-xss-sanitizer"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/express-xss-sanitizer"
},
{
"type": "WEB",
"url": "https://www.tenable.com/cve/CVE-2025-59364"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "express-xss-sanitizer has an unbounded recursion depth"
}
GHSA-HWFH-MH4F-M67F
Vulnerability from github – Published: 2026-05-14 15:31 – Updated: 2026-05-14 15:31Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
{
"affected": [],
"aliases": [
"CVE-2026-6479"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-14T14:16:25Z",
"severity": "HIGH"
},
"details": "Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.",
"id": "GHSA-hwfh-mh4f-m67f",
"modified": "2026-05-14T15:31:58Z",
"published": "2026-05-14T15:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6479"
},
{
"type": "WEB",
"url": "https://www.postgresql.org/support/security/CVE-2026-6479"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HWXV-7GW9-PFM4
Vulnerability from github – Published: 2022-05-13 01:08 – Updated: 2022-05-13 01:08An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.
{
"affected": [],
"aliases": [
"CVE-2019-9543"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-01T19:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.",
"id": "GHSA-hwxv-7gw9-pfm4",
"modified": "2022-05-13T01:08:19Z",
"published": "2022-05-13T01:08:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9543"
},
{
"type": "WEB",
"url": "https://gitlab.freedesktop.org/poppler/poppler/issues/730"
},
{
"type": "WEB",
"url": "https://research.loginsoft.com/bugs/recursive-function-call-in-function-jbig2streamreadgenericbitmap-poppler-0-74-0"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/107238"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
Mitigation
Increase the stack size.
CAPEC-230: Serialized Data with Nested Payloads
Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization.
CAPEC-231: Oversized Serialized Data Payloads
An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.