CWE-674
Allowed-with-ReviewUncontrolled Recursion
Abstraction: Class · Status: Draft
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
755 vulnerabilities reference this CWE, most recent first.
GHSA-RMMH-P597-PPVV
Vulnerability from github – Published: 2024-02-26 21:31 – Updated: 2026-04-24 20:36Showdownjs, versions <= 2.1.0, anchors subparser used to parse links has a nested regular expression which can lead to denial of service conditions given malicious input.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "showdown"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-1899"
],
"database_specific": {
"cwe_ids": [
"CWE-674",
"CWE-777"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-24T20:36:01Z",
"nvd_published_at": "2024-02-26T19:15:07Z",
"severity": "MODERATE"
},
"details": "Showdownjs, versions \u003c= 2.1.0, `anchors` subparser used to parse links has a nested regular expression which can lead to denial of service conditions given malicious input.",
"id": "GHSA-rmmh-p597-ppvv",
"modified": "2026-04-24T20:36:01Z",
"published": "2024-02-26T21:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1899"
},
{
"type": "PACKAGE",
"url": "https://github.com/showdownjs/showdown"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2024-05"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing"
}
GHSA-RQXM-JX33-WRQR
Vulnerability from github – Published: 2026-09-01 18:30 – Updated: 2026-09-02 15:34llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_alloc and HTTP 500) via a negative top_n value in a POST request to /rerank.
{
"affected": [],
"aliases": [
"CVE-2026-52132"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-01T18:17:43Z",
"severity": "HIGH"
},
"details": "llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_alloc and HTTP 500) via a negative top_n value in a POST request to /rerank.",
"id": "GHSA-rqxm-jx33-wrqr",
"modified": "2026-09-02T15:34:35Z",
"published": "2026-09-01T18:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52132"
},
{
"type": "WEB",
"url": "https://blog.ph4nt0m.xyz/ko/cves/cve-2026-52132"
},
{
"type": "WEB",
"url": "https://github.com/ggml-org/llama.cpp"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RV48-QQJ5-CRXG
Vulnerability from github – Published: 2026-07-15 17:44 – Updated: 2026-07-15 17:44Summary
Unbounded recursion depth in Protobuf.Decoder (Hex package protobuf, versions >= 0.8.0, < 0.16.1) lets an unauthenticated attacker crash any service that decodes untrusted protobuf messages whose schema contains a self-referential or cyclic message type. A small request body (a few KB to a few MB) that nests an embedded field hundreds of thousands to millions of levels deep forces the BEAM to recurse once per level, exhausting memory and pinning a scheduler. A handful of such requests can take the node offline (a request-amplification denial of service).
Details
Protobuf.Decoder.value_for_field/3 handles embedded message fields in its embedded?: true branch at lib/protobuf/decoder.ex:218-243. For an embedded field it calls decode(bin, type) recursively, which re-enters build_message → handle_value → value_for_field. The recursive call is not in tail position (its result is consumed by the surrounding decode after it returns), so every nesting level retains a live frame on the process stack and heap.
There is no recursion-depth counter anywhere in the decoder. For any schema with a self-referential message type (e.g. message Tree { Tree child = 1; }, a common shape for comment threads, org charts, file trees, and ASTs) or any cycle of message types, the attacker controls the nesting depth entirely through the input bytes. Each additional level costs only a 1-byte field tag plus a varint length prefix, so depth grows roughly inversely with payload size: a tiny body buys an enormous recursion depth.
Reference protobuf implementations (Google's C++, Java, etc.) cap recursion at 100 specifically to prevent this. The Elixir decoder enforces no comparable bound, so the recursion continues until the process exhausts memory, blows the stack, or starves the scheduler doing GC over the deep structure.
The fix threads a depth counter through decode / build_message / handle_value / value_for_field (or holds it in the process dictionary for the duration of the top-level decode) and raises Protobuf.DecodeError once it exceeds a configurable limit, defaulting to 100 to match the reference implementations.
PoC
- Define a self-referential schema:
defmodule Tree do use Protobuf, syntax: :proto3; field(:child, 1, type: Tree) end. - Build a wire-format body inner-to-outer: at each of
depthlevels prepend<<0x0A, length_varint(inner_size), inner>>(tag0x0A= field 1, wire type 2). Use an iolist with a running byte-size to keep generation O(depth). - POST the body (a few MB at
depth = 1_000_000) asapplication/x-protobufto any endpoint that callsTree.decode/1. - The non-tail
decode(bin, type)invalue_for_field/3re-enters once per nesting level, accumulating a frame per level. The decode burns seconds of CPU and hundreds of MB on the victim node; a few concurrent requests exhaust it.
Impact
Unauthenticated, network-reachable request-amplification denial of service against any service that decodes attacker-influenced protobuf bytes into a self-referential or cyclic message type. A single small request can consume seconds of CPU and hundreds of MB of memory on the victim; a few concurrent requests can take the node offline.
Resources
- Introduction commit: https://github.com/elixir-protobuf/protobuf/commit/21ec7c5bec4fec74e10c1de0d5d1a2d8152ac5d4
- Patch commit: https://github.com/elixir-protobuf/protobuf/commit/b8efa97790eece3d2d0e8e7c31a45ed409fe5338
{
"affected": [
{
"package": {
"ecosystem": "Hex",
"name": "protobuf"
},
"ranges": [
{
"events": [
{
"introduced": "0.8.0"
},
{
"fixed": "0.16.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54451"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-15T17:44:28Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\nUnbounded recursion depth in `Protobuf.Decoder` (Hex package `protobuf`, versions `\u003e= 0.8.0, \u003c 0.16.1`) lets an unauthenticated attacker crash any service that decodes untrusted protobuf messages whose schema contains a self-referential or cyclic message type. A small request body (a few KB to a few MB) that nests an embedded field hundreds of thousands to millions of levels deep forces the BEAM to recurse once per level, exhausting memory and pinning a scheduler. A handful of such requests can take the node offline (a request-amplification denial of service).\n\n### Details\n\n`Protobuf.Decoder.value_for_field/3` handles embedded message fields in its `embedded?: true` branch at `lib/protobuf/decoder.ex:218-243`. For an embedded field it calls `decode(bin, type)` recursively, which re-enters `build_message \u2192 handle_value \u2192 value_for_field`. The recursive call is not in tail position (its result is consumed by the surrounding decode after it returns), so every nesting level retains a live frame on the process stack and heap.\n\nThere is no recursion-depth counter anywhere in the decoder. For any schema with a self-referential message type (e.g. `message Tree { Tree child = 1; }`, a common shape for comment threads, org charts, file trees, and ASTs) or any cycle of message types, the attacker controls the nesting depth entirely through the input bytes. Each additional level costs only a 1-byte field tag plus a varint length prefix, so depth grows roughly inversely with payload size: a tiny body buys an enormous recursion depth.\n\nReference protobuf implementations (Google\u0027s C++, Java, etc.) cap recursion at 100 specifically to prevent this. The Elixir decoder enforces no comparable bound, so the recursion continues until the process exhausts memory, blows the stack, or starves the scheduler doing GC over the deep structure.\n\nThe fix threads a depth counter through `decode / build_message / handle_value / value_for_field` (or holds it in the process dictionary for the duration of the top-level `decode`) and raises `Protobuf.DecodeError` once it exceeds a configurable limit, defaulting to 100 to match the reference implementations.\n\n### PoC\n\n1. Define a self-referential schema: `defmodule Tree do use Protobuf, syntax: :proto3; field(:child, 1, type: Tree) end`.\n2. Build a wire-format body inner-to-outer: at each of `depth` levels prepend `\u003c\u003c0x0A, length_varint(inner_size), inner\u003e\u003e` (tag `0x0A` = field 1, wire type 2). Use an iolist with a running byte-size to keep generation O(depth).\n3. POST the body (a few MB at `depth = 1_000_000`) as `application/x-protobuf` to any endpoint that calls `Tree.decode/1`.\n4. The non-tail `decode(bin, type)` in `value_for_field/3` re-enters once per nesting level, accumulating a frame per level. The decode burns seconds of CPU and hundreds of MB on the victim node; a few concurrent requests exhaust it.\n\n### Impact\n\nUnauthenticated, network-reachable request-amplification denial of service against any service that decodes attacker-influenced protobuf bytes into a self-referential or cyclic message type. A single small request can consume seconds of CPU and hundreds of MB of memory on the victim; a few concurrent requests can take the node offline. \n\n## Resources\n\n* Introduction commit: https://github.com/elixir-protobuf/protobuf/commit/21ec7c5bec4fec74e10c1de0d5d1a2d8152ac5d4\n* Patch commit: https://github.com/elixir-protobuf/protobuf/commit/b8efa97790eece3d2d0e8e7c31a45ed409fe5338",
"id": "GHSA-rv48-qqj5-crxg",
"modified": "2026-07-15T17:44:28Z",
"published": "2026-07-15T17:44:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/elixir-protobuf/protobuf/security/advisories/GHSA-rv48-qqj5-crxg"
},
{
"type": "WEB",
"url": "https://github.com/elixir-protobuf/protobuf/commit/21ec7c5bec4fec74e10c1de0d5d1a2d8152ac5d4"
},
{
"type": "WEB",
"url": "https://github.com/elixir-protobuf/protobuf/commit/b8efa97790eece3d2d0e8e7c31a45ed409fe5338"
},
{
"type": "PACKAGE",
"url": "https://github.com/elixir-protobuf/protobuf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Protobuf: Unbounded recursion depth in embedded-message decoding"
}
GHSA-RV9V-R4VM-GJ8X
Vulnerability from github – Published: 2024-08-19 03:30 – Updated: 2024-09-09 18:20The Miniscript (aka rust-miniscript) library for Rust allows stack consumption because it does not properly track tree depth.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "miniscript"
},
"ranges": [
{
"events": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.2.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "miniscript"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.2.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "miniscript"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.2.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "miniscript"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-44073"
],
"database_specific": {
"cwe_ids": [
"CWE-674",
"CWE-770",
"CWE-787"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-19T18:25:09Z",
"nvd_published_at": "2024-08-19T03:15:03Z",
"severity": "MODERATE"
},
"details": "The Miniscript (aka rust-miniscript) library for Rust allows stack consumption because it does not properly track tree depth.",
"id": "GHSA-rv9v-r4vm-gj8x",
"modified": "2024-09-09T18:20:53Z",
"published": "2024-08-19T03:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44073"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/704"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/712"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/712/files"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/713/files"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/714/files"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/715/files"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/commit/5b0f5e3417f027a22b066debf825dbe6644b575b"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/commit/8f54b5e3fb7129ed9fbed53f1cb9e6e62ea4c151"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Miniscript allows stack consumption"
}
GHSA-RVHP-MGHQ-8MVW
Vulnerability from github – Published: 2026-02-14 00:32 – Updated: 2026-02-18 15:31A Denial of Service (DoS) vulnerability was discovered in the TON Lite Server before v2024.09. The vulnerability arises from the handling of external arguments passed to locally executed "get methods." An attacker can inject a constructed Continuation object (an internal TVM type) that is normally restricted within the VM. When the TVM executes this malicious continuation, it consumes excessive CPU resources while accruing disproportionately low virtual gas costs. This "free" computation allows an attacker to monopolize the Lite Server's processing power, significantly reducing its throughput and causing a denial of service for legitimate users acting through the gateway.
{
"affected": [],
"aliases": [
"CVE-2025-70957"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-13T22:16:10Z",
"severity": "HIGH"
},
"details": "A Denial of Service (DoS) vulnerability was discovered in the TON Lite Server before v2024.09. The vulnerability arises from the handling of external arguments passed to locally executed \"get methods.\" An attacker can inject a constructed Continuation object (an internal TVM type) that is normally restricted within the VM. When the TVM executes this malicious continuation, it consumes excessive CPU resources while accruing disproportionately low virtual gas costs. This \"free\" computation allows an attacker to monopolize the Lite Server\u0027s processing power, significantly reducing its throughput and causing a denial of service for legitimate users acting through the gateway.",
"id": "GHSA-rvhp-mghq-8mvw",
"modified": "2026-02-18T15:31:24Z",
"published": "2026-02-14T00:32:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70957"
},
{
"type": "WEB",
"url": "https://github.com/ton-blockchain/ton/commit/e35b34de22109596a54d1357dcce92d63002ba95"
},
{
"type": "WEB",
"url": "https://gist.github.com/Lucian-code233/d2589ece39914195c0e307b4dee32185"
},
{
"type": "WEB",
"url": "https://mp.weixin.qq.com/s/KT4RKNey_mjU2kBWpGTjuw"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RVV3-G6HJ-G44X
Vulnerability from github – Published: 2026-03-13 20:57 – Updated: 2026-03-25 18:53Summary
AutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread's stack memory, triggering a StackOverflowException and causing the entire application process to terminate.
Description
The vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level.
Because there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since StackOverflowException cannot be caught in modern .NET runtimes, the application cannot recover and will crash immediately.
Impact
- Availability: An attacker can crash the application server, leading to a complete Denial of Service.
- Process Termination: Unlike standard exceptions, this terminates the entire process, not just the individual request thread.
Proof of Concept (PoC)
The following C# code demonstrates the crash by creating a nested "Circular" object graph and attempting to map it:
class Circular { public Circular Self { get; set; } }
// Setup configuration
var config = new MapperConfiguration(cfg => {
cfg.CreateMap<Circular, Circular>();
});
var mapper = config.CreateMapper();
// Create a deeply nested object (28,000+ levels)
var root = new Circular();
var current = root;
for (int i = 0; i < 30000; i++) {
current.Self = new Circular();
current = current.Self;
}
// This call triggers the StackOverflowException and crashes the process
mapper.Map<Circular>(root);
Recommended Mitigation
- Secure Defaults: Implement a default
MaxDepth(e.g., 32 or 64) for all mapping operations. - Configurable Limit: Allow users to increase this limit if necessary, but ensure it is enabled by default to protect unsuspecting developers.
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "AutoMapper"
},
"ranges": [
{
"events": [
{
"introduced": "16.0.0"
},
{
"fixed": "16.1.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "AutoMapper"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "15.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-32933"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-13T20:57:07Z",
"nvd_published_at": "2026-03-20T03:16:00Z",
"severity": "HIGH"
},
"details": "### Summary\n\nAutoMapper is vulnerable to a Denial of Service (DoS) attack. When mapping deeply nested object graphs, the library uses recursive method calls without enforcing a default maximum depth limit. This allows an attacker to provide a specially crafted object graph that exhausts the thread\u0027s stack memory, triggering a `StackOverflowException` and causing the entire application process to terminate.\n\n### Description\n\nThe vulnerability exists in the core mapping engine. When a source object contains a property of the same type (or a type that eventually points back to itself), AutoMapper recursively attempts to map each level.\n\nBecause there is no default limit on how many levels deep this recursion can go, a sufficiently nested object (approximately 25,000+ levels in standard .NET environments) will exceed the stack size. Since `StackOverflowException` cannot be caught in modern .NET runtimes, the application cannot recover and will crash immediately.\n\n### Impact\n\n* **Availability:** An attacker can crash the application server, leading to a complete Denial of Service.\n* **Process Termination:** Unlike standard exceptions, this terminates the entire process, not just the individual request thread.\n\n### Proof of Concept (PoC)\n\nThe following C# code demonstrates the crash by creating a nested \"Circular\" object graph and attempting to map it:\n\n```csharp\nclass Circular { public Circular Self { get; set; } }\n\n// Setup configuration\nvar config = new MapperConfiguration(cfg =\u003e {\n cfg.CreateMap\u003cCircular, Circular\u003e();\n});\nvar mapper = config.CreateMapper();\n\n// Create a deeply nested object (28,000+ levels)\nvar root = new Circular();\nvar current = root;\nfor (int i = 0; i \u003c 30000; i++) {\n current.Self = new Circular();\n current = current.Self;\n}\n\n// This call triggers the StackOverflowException and crashes the process\nmapper.Map\u003cCircular\u003e(root);\n\n```\n\n### Recommended Mitigation\n\n1. **Secure Defaults:** Implement a default `MaxDepth` (e.g., 32 or 64) for all mapping operations.\n2. **Configurable Limit:** Allow users to increase this limit if necessary, but ensure it is enabled by default to protect unsuspecting developers.",
"id": "GHSA-rvv3-g6hj-g44x",
"modified": "2026-03-25T18:53:07Z",
"published": "2026-03-13T20:57:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/LuckyPennySoftware/AutoMapper/security/advisories/GHSA-rvv3-g6hj-g44x"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32933"
},
{
"type": "WEB",
"url": "https://github.com/LuckyPennySoftware/AutoMapper/commit/0afaf1e91648fca1a57512e94dd00a76ee016816"
},
{
"type": "PACKAGE",
"url": "https://github.com/LuckyPennySoftware/AutoMapper"
},
{
"type": "WEB",
"url": "https://github.com/LuckyPennySoftware/AutoMapper/discussions/4624"
},
{
"type": "WEB",
"url": "https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v15.1.1"
},
{
"type": "WEB",
"url": "https://github.com/LuckyPennySoftware/AutoMapper/releases/tag/v16.1.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion"
}
GHSA-RX25-RPPP-X99W
Vulnerability from github – Published: 2026-02-04 18:30 – Updated: 2026-06-01 18:31In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix recvmsg() unconditional requeue
If rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at the front of the recvmsg queue already has its mutex locked, it requeues the call - whether or not the call is already queued. The call may be on the queue because MSG_PEEK was also passed and so the call was not dequeued or because the I/O thread requeued it.
The unconditional requeue may then corrupt the recvmsg queue, leading to things like UAFs or refcount underruns.
Fix this by only requeuing the call if it isn't already on the queue - and moving it to the front if it is already queued. If we don't queue it, we have to put the ref we obtained by dequeuing it.
Also, MSG_PEEK doesn't dequeue the call so shouldn't call rxrpc_notify_socket() for the call if we didn't use up all the data on the queue, so fix that also.
{
"affected": [],
"aliases": [
"CVE-2026-23066"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-04T17:16:17Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix recvmsg() unconditional requeue\n\nIf rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at\nthe front of the recvmsg queue already has its mutex locked, it requeues\nthe call - whether or not the call is already queued. The call may be on\nthe queue because MSG_PEEK was also passed and so the call was not dequeued\nor because the I/O thread requeued it.\n\nThe unconditional requeue may then corrupt the recvmsg queue, leading to\nthings like UAFs or refcount underruns.\n\nFix this by only requeuing the call if it isn\u0027t already on the queue - and\nmoving it to the front if it is already queued. If we don\u0027t queue it, we\nhave to put the ref we obtained by dequeuing it.\n\nAlso, MSG_PEEK doesn\u0027t dequeue the call so shouldn\u0027t call\nrxrpc_notify_socket() for the call if we didn\u0027t use up all the data on the\nqueue, so fix that also.",
"id": "GHSA-rx25-rppp-x99w",
"modified": "2026-06-01T18:31:22Z",
"published": "2026-02-04T18:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23066"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0464bf75590da75b8413c3e758c04647b4cdb3c6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2c28769a51deb6022d7fbd499987e237a01dd63a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8fd3b5e297854a4da0f273169baf4b1b7b257b97"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/930114425065f7ace6e0c0630fab4af75e059ea8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c198628f3fca5c874d93874c233014d336e09f64"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c6cebcb4e0b3140ec2ace45c020a9049527385d1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cf969bddd6e69c5777fa89dc88402204e72f312a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RX34-F5M9-H9P5
Vulnerability from github – Published: 2026-08-13 21:36 – Updated: 2026-08-13 21:36Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.
{
"affected": [],
"aliases": [
"CVE-2026-72638"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T20:17:24Z",
"severity": "MODERATE"
},
"details": "Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.",
"id": "GHSA-rx34-f5m9-h9p5",
"modified": "2026-08-13T21:36:07Z",
"published": "2026-08-13T21:36:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72638"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-119/389498"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RXF6-323F-44FC
Vulnerability from github – Published: 2025-07-05 03:30 – Updated: 2025-08-01 19:17Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-2gh3-rmm4-6rq5. This link is maintained to preserve external references.
The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "protobuf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-07T21:59:34Z",
"nvd_published_at": "2025-07-05T01:15:28Z",
"severity": "MODERATE"
},
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-2gh3-rmm4-6rq5. This link is maintained to preserve external references.\n\n###\nThe protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.",
"id": "GHSA-rxf6-323f-44fc",
"modified": "2025-08-01T19:17:10Z",
"published": "2025-07-05T03:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53605"
},
{
"type": "WEB",
"url": "https://github.com/stepancheg/rust-protobuf/issues/749"
},
{
"type": "WEB",
"url": "https://github.com/stepancheg/rust-protobuf/commit/ee1d928785cff80cbdbedde29fbf5210654410f0"
},
{
"type": "WEB",
"url": "https://crates.io/crates/protobuf"
},
{
"type": "PACKAGE",
"url": "https://github.com/stepancheg/rust-protobuf"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2024-0437"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Duplicate Advisory: rust-protobuf crate is vulnerable to Uncontrolled Recursion, potentially leading to DoS",
"withdrawn": "2025-08-01T19:17:10Z"
}
GHSA-V3QX-X9JR-G987
Vulnerability from github – Published: 2022-05-24 17:16 – Updated: 2024-04-04 02:50In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).
{
"affected": [],
"aliases": [
"CVE-2020-12243"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-28T19:15:00Z",
"severity": "HIGH"
},
"details": "In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).",
"id": "GHSA-v3qx-x9jr-g987",
"modified": "2024-04-04T02:50:23Z",
"published": "2022-05-24T17:16:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12243"
},
{
"type": "WEB",
"url": "https://bugs.openldap.org/show_bug.cgi?id=9202"
},
{
"type": "WEB",
"url": "https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES"
},
{
"type": "WEB",
"url": "https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00001.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20200511-0003"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT211289"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4352-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4352-2"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2020/dsa-4666"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
Mitigation
Increase the stack size.
CAPEC-230: Serialized Data with Nested Payloads
Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization.
CAPEC-231: Oversized Serialized Data Payloads
An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.