CWE-674
Allowed-with-ReviewUncontrolled Recursion
Abstraction: Class · Status: Draft
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
802 vulnerabilities reference this CWE, most recent first.
GHSA-PPC9-VW33-PG6G
Vulnerability from github – Published: 2025-08-04 18:30 – Updated: 2025-08-04 21:30An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file. This can lead to a Denial of Service (DoS).
{
"affected": [],
"aliases": [
"CVE-2025-50420"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-04T17:15:30Z",
"severity": "HIGH"
},
"details": "An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file. This can lead to a Denial of Service (DoS).",
"id": "GHSA-ppc9-vw33-pg6g",
"modified": "2025-08-04T21:30:42Z",
"published": "2025-08-04T18:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50420"
},
{
"type": "WEB",
"url": "https://github.com/Landw-hub/CVE-2025-50420"
},
{
"type": "WEB",
"url": "http://freedesktop.com"
},
{
"type": "WEB",
"url": "http://poppler.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PPRH-WGQR-2MMX
Vulnerability from github – Published: 2026-08-16 15:30 – Updated: 2026-08-16 15:30Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process.
{
"affected": [],
"aliases": [
"CVE-2026-74794"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-16T14:16:57Z",
"severity": "HIGH"
},
"details": "Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process.",
"id": "GHSA-pprh-wgqr-2mmx",
"modified": "2026-08-16T15:30:27Z",
"published": "2026-08-16T15:30:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/scriban/scriban/security/advisories/GHSA-grr9-747v-xvcp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74794"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/scriban-before-denial-of-service-via-infinite-recursion"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PQ2G-WX69-C263
Vulnerability from github – Published: 2025-02-06 06:31 – Updated: 2025-03-12 14:28A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370.
The fixed version only addresses the default modes provided by JSONParser, such as MODE_RFC4627. If you create the JSONParser manually or with custom options, make sure to set the LIMIT_JSON_DEPTH option.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "net.minidev:json-smart"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-57699"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2025-02-06T19:01:17Z",
"nvd_published_at": "2025-02-05T22:15:33Z",
"severity": "HIGH"
},
"details": "A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of \u2019{\u2019, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370.\n\nThe fixed version only addresses the default modes provided by [JSONParser](https://github.com/netplex/json-smart-v2/blob/master/json-smart/src/main/java/net/minidev/json/parser/JSONParser.java#L118), such as `MODE_RFC4627`. If you create the JSONParser manually or with custom options, make sure to set the `LIMIT_JSON_DEPTH` option.",
"id": "GHSA-pq2g-wx69-c263",
"modified": "2025-03-12T14:28:04Z",
"published": "2025-02-06T06:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57699"
},
{
"type": "WEB",
"url": "https://github.com/netplex/json-smart-v2/issues/232"
},
{
"type": "WEB",
"url": "https://github.com/netplex/json-smart-v2/issues/233"
},
{
"type": "WEB",
"url": "https://github.com/netplex/json-smart-v2/issues/236"
},
{
"type": "WEB",
"url": "https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699"
},
{
"type": "PACKAGE",
"url": "https://github.com/netplex/json-smart-v2"
},
{
"type": "WEB",
"url": "https://github.com/netplex/json-smart-v2/releases/tag/2.5.2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-1370"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Netplex Json-smart Uncontrolled Recursion vulnerability"
}
GHSA-PQ8H-22GG-VPMW
Vulnerability from github – Published: 2022-05-24 17:25 – Updated: 2022-10-29 12:00In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME parts.
{
"affected": [],
"aliases": [
"CVE-2020-12100"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-08-12T16:15:00Z",
"severity": "MODERATE"
},
"details": "In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME parts.",
"id": "GHSA-pq8h-22gg-vpmw",
"modified": "2022-10-29T12:00:36Z",
"published": "2022-05-24T17:25:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12100"
},
{
"type": "WEB",
"url": "https://dovecot.org/security"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00024.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4AAX2MJEULPVSRZOBX3PNPFSYP4FM4TT"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EYZU6CHA3VMYYAUCMHSCCQKJEVEIKPQ2"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XKKAL3OMG76ZZ7CIEMQP2K6KCTD2RAKE"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202009-02"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4456-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4456-2"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4745"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/Jan/18"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/08/12/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/01/04/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PQHP-25J4-6HQ9
Vulnerability from github – Published: 2024-11-22 20:40 – Updated: 2024-11-22 20:40Summary
An attacker can send a maliciously crafted TOML to cause the parser to crash because of a stack overflow caused by a deeply nested inline structure. A similar problem occurs when attempting to stringify deeply nested objects.
The library does not limit the maximum exploration depth while parsing or producing TOML documents, nor does it offer a way to do so.
Proof of concept
require("smol-toml").parse("e=" + "{e=".repeat(9999) + "{}" + "}".repeat(9999))
Impact
Applications which parse arbitrary TOML documents may suffer availability issues if they receive malicious input. If uncaught, the crash may cause the application itself to crash. The impact is deemed minor, as the function is already likely to throw errors on invalid input and therefore to properly handle errors.
Due to the design of most JavaScript runtimes, the uncontrolled recursion does not lead to excessive memory usage and the execution is quickly aborted.
As a reminder, it is strongly advised when working with untrusted user input to expect errors to occur and to appropriately catch them.
Patches
Version 1.3.1 offers a mechanism to limit the exploration depth before halting with a TomlError when parsing, with a default cap of 1000. A same mechanism has been implemented for stringifying objects.
Please note that the parser will still throw an error upon such cases. It is, however, a now-controlled and documented behavior of the library.
Workarounds
Wrap all invocations of parse and stringify in a try/catch block.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.3.0"
},
"package": {
"ecosystem": "npm",
"name": "smol-toml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2024-11-22T20:40:49Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nAn attacker can send a maliciously crafted TOML to cause the parser to crash because of a stack overflow caused by a deeply nested inline structure. A similar problem occurs when attempting to stringify deeply nested objects.\n\nThe library does not limit the maximum exploration depth while parsing or producing TOML documents, nor does it offer a way to do so.\n\n### Proof of concept\n```js\nrequire(\"smol-toml\").parse(\"e=\" + \"{e=\".repeat(9999) + \"{}\" + \"}\".repeat(9999))\n```\n\n### Impact\nApplications which parse arbitrary TOML documents may suffer availability issues if they receive malicious input. If uncaught, the crash may cause the application itself to crash. The impact is deemed minor, as the function is already likely to throw errors on invalid input and therefore to properly handle errors.\n\nDue to the design of most JavaScript runtimes, the uncontrolled recursion does not lead to excessive memory usage and the execution is quickly aborted.\n\nAs a reminder, it is **strongly** advised when working with untrusted user input to expect errors to occur and to appropriately catch them.\n\n### Patches\nVersion 1.3.1 offers a mechanism to limit the exploration depth before halting with a `TomlError` when parsing, with a default cap of 1000. A same mechanism has been implemented for stringifying objects.\n\n**Please note that the parser will *still* throw an error upon such cases.** It is, however, a now-controlled and documented behavior of the library.\n\n### Workarounds\nWrap all invocations of `parse` and `stringify` in a try/catch block.",
"id": "GHSA-pqhp-25j4-6hq9",
"modified": "2024-11-22T20:40:49Z",
"published": "2024-11-22T20:40:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-pqhp-25j4-6hq9"
},
{
"type": "WEB",
"url": "https://github.com/squirrelchat/smol-toml/commit/405108ba090f0fc78f99aa2f0d6721e499b0ff27"
},
{
"type": "PACKAGE",
"url": "https://github.com/squirrelchat/smol-toml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables"
}
GHSA-PVVG-CG5R-2Q8V
Vulnerability from github – Published: 2022-05-13 01:23 – Updated: 2022-05-13 01:23An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file image.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
{
"affected": [],
"aliases": [
"CVE-2019-9143"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-25T15:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file image.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.",
"id": "GHSA-pvvg-cg5r-2q8v",
"modified": "2022-05-13T01:23:02Z",
"published": "2022-05-13T01:23:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9143"
},
{
"type": "WEB",
"url": "https://github.com/Exiv2/exiv2/issues/711"
},
{
"type": "WEB",
"url": "https://research.loginsoft.com/bugs/uncontrolled-recursion-loop-in-exiv2imageprinttiffstructure-exiv2-0-27"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/107161"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PWF9-Q62P-V7WC
Vulnerability from github – Published: 2025-03-16 06:30 – Updated: 2025-03-18 21:06Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.squareup.wire:wire-runtime"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-58103"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-18T21:06:13Z",
"nvd_published_at": "2025-03-16T04:15:12Z",
"severity": "MODERATE"
},
"details": "Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.",
"id": "GHSA-pwf9-q62p-v7wc",
"modified": "2025-03-18T21:06:13Z",
"published": "2025-03-16T06:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58103"
},
{
"type": "WEB",
"url": "https://github.com/square/wire/commit/b90e60c09befaff836a2fc2ee4d678451b2ec75d"
},
{
"type": "PACKAGE",
"url": "https://github.com/square/wire"
},
{
"type": "WEB",
"url": "https://github.com/square/wire/compare/5.1.0...5.2.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Wire has Uncontrolled Recursion on Nested Groups"
}
GHSA-PWR2-4V36-6QPR
Vulnerability from github – Published: 2024-02-26 18:30 – Updated: 2024-02-26 22:06orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "orjson"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-27454"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-26T21:31:06Z",
"nvd_published_at": "2024-02-26T16:28:00Z",
"severity": "HIGH"
},
"details": "orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.",
"id": "GHSA-pwr2-4v36-6qpr",
"modified": "2024-02-26T22:06:16Z",
"published": "2024-02-26T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27454"
},
{
"type": "WEB",
"url": "https://github.com/ijl/orjson/issues/458"
},
{
"type": "WEB",
"url": "https://github.com/ijl/orjson/commit/b0e4d2c06ce06c6e63981bf0276e4b7c74e5845e"
},
{
"type": "PACKAGE",
"url": "https://github.com/ijl/orjson"
},
{
"type": "WEB",
"url": "https://github.com/ijl/orjson/blob/master/CHANGELOG.md#3915"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/orjson/PYSEC-2024-40.yaml"
},
{
"type": "WEB",
"url": "https://monicz.dev/CVE-2024-27454"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "orjson does not limit recursion for deeply nested JSON documents"
}
GHSA-Q238-5CXM-5C9H
Vulnerability from github – Published: 2026-08-04 18:31 – Updated: 2026-08-04 18:31An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the django.contrib.gis.forms.GeometryField form field are also affected.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.
{
"affected": [],
"aliases": [
"CVE-2026-15830"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-04T17:16:46Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\nGeoDjango\u0027s `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.",
"id": "GHSA-q238-5cxm-5c9h",
"modified": "2026-08-04T18:31:27Z",
"published": "2026-08-04T18:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15830"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/6af5da31775417c610dbf9c3f1b5b8333d42daf6"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/9e4a3f186b6b07b483bfd9195ea06734663fcd06"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/ba80833fa656dd09660b97c4429331067db1b080"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/d2e59b77fe18de318a8272c2a7bbc798d84d1d0d"
},
{
"type": "WEB",
"url": "https://docs.djangoproject.com/en/dev/releases/security"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/django-announce"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2026/aug/04/security-releases"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-Q2RR-FHP3-V3J2
Vulnerability from github – Published: 2022-05-24 17:00 – Updated: 2022-05-24 17:00An exploitable denial-of-service vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. When parsing labels in mDNS packets, the firewall unsafely handles label compression pointers, leading to an uncontrolled recursion that eventually exhausts the stack, crashing the mdnscap process. An unauthenticated attacker can send an mDNS message to trigger this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2018-4002"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-31T21:15:00Z",
"severity": "HIGH"
},
"details": "An exploitable denial-of-service vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. When parsing labels in mDNS packets, the firewall unsafely handles label compression pointers, leading to an uncontrolled recursion that eventually exhausts the stack, crashing the mdnscap process. An unauthenticated attacker can send an mDNS message to trigger this vulnerability.",
"id": "GHSA-q2rr-fhp3-v3j2",
"modified": "2022-05-24T17:00:08Z",
"published": "2022-05-24T17:00:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-4002"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2018-0671"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
Mitigation
Increase the stack size.
CAPEC-230: Serialized Data with Nested Payloads
Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization.
CAPEC-231: Oversized Serialized Data Payloads
An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.