CWE-674 · Uncontrolled Recursion (page 3)
Page 3 of 5 — CVEs classified under CWE-674, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8732 | Low | 3.3 | 2025-08-08 | A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the comp… |
CVE-2025-23325 | High | 7.5 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause uncontrolled recursion through a specially crafted… |
CVE-2025-46206 | Medium | 6.5 | 2025-08-04 | An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When pr… |
CVE-2025-50420 | Medium | 6.5 | 2025-08-04 | An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file. This can… |
CVE-2025-38493 | Medium | 5.5 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Fix crash in timerlat_dump_stack() We have observed kernel panics when u… |
CVE-2024-58264 | Low | 3.2 | 2025-07-27 | The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data. |
CVE-2025-38459 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [… |
CVE-2025-48924 | Medium | 5.3 | 2025-07-11 | Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and… |
CVE-2025-53864 | Medium | 5.8 | 2025-07-11 | Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON objec… |
CVE-2025-38315 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Check dsbr size from EFI variable Since the size of struct btintel_ds… |
CVE-2025-5472 | Medium | 6.5 | 2025-07-07 | The JSONReader in run-llama/llama_index versions 0.12.28 is vulnerable to a stack overflow due to uncontrolled recursive JSON parsing. This vulnerability allow… |
CVE-2025-53605 | Medium | 5.9 | 2025-07-05 | The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fie… |
CVE-2025-6710 | High | 7.5 | 2025-06-26 | MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recu… |
CVE-2022-50118 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: powerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_… |
CVE-2025-4565 | Medium | 5.3 | 2025-06-16 | Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messa… |
CVE-2025-20678 | Medium | 6.5 | 2025-06-02 | In ims service, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue… |
CVE-2025-30193 | High | 7.5 | 2025-05-20 | In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client, an attacker can c… |
CVE-2025-1752 | High | 7.5 | 2025-05-10 | A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ lates… |
CVE-2025-37851 | Medium | 5.5 | 2025-05-09 | In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: Add 'plane' value check Function dispc_ovl_setup is not intended to work w… |
CVE-2022-49782 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: perf: Improve missing SIGTRAP checking To catch missing SIGTRAP we employ a WARN in __per… |
CVE-2025-43708 | Low | 3.3 | 2025-04-17 | VisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowError when reference='… |
CVE-2025-32387 | Medium | 6.5 | 2025-04-09 | Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to pars… |
CVE-2023-52986 | Medium | 5.5 | 2025-03-27 | In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener A listening socket l… |
CVE-2024-12910 | Medium | 5.9 | 2025-03-20 | A vulnerability in the `KnowledgeBaseWebReader` class of the run-llama/llama_index repository, version latest, allows an attacker to cause a Denial of Service… |
CVE-2024-58103 | Medium | 5.8 | 2025-03-16 | Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt. |
CVE-2024-8176 | High | 7.5 | 2025-03-14 | A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML docume… |
CVE-2024-58102 | Medium | 5.7 | 2025-03-11 | An issue was discovered in Datalust Seq before 2024.3.13545. An insecure default parsing depth limit allows stack consumption when parsing user-supplied querie… |
CVE-2025-1492 | High | 7.8 | 2025-02-20 | Bundle Protocol and CBOR dissector crashes in Wireshark 4.4.0 to 4.4.3 and 4.2.0 to 4.2.10 allows denial of service via packet injection or crafted capture file |
CVE-2024-57257 | Low | 2.0 | 2025-02-18 | A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting. |
CVE-2024-57699 | High | 7.5 | 2025-02-05 | A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack ex… |
CVE-2024-54731 | Medium | 4.0 | 2025-01-08 | cpdf through 2.8 allows stack consumption via a crafted PDF document. |
CVE-2024-49363 | High | 7.4 | 2024-12-18 | Misskey is an open source, federated social media platform. In affected versions FileServerService (media proxy) in github.com/misskey-dev/misskey 2024.10.1 or… |
CVE-2023-29001 | High | 7.5 | 2024-11-27 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. The Contiki-NG operating system processes source routing headers (SRH) in its tw… |
CVE-2024-53090 | High | 7.5 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix lock recursion afs_wake_up_async_call() can incur lock recursion. The problem i… |
CVE-2021-41737 | High | 7.5 | 2024-11-10 | In Faust 2.23.1, an input file with the lines "// r visualisation tCst" and "//process = +: L: abM-^Q;" and "process = route(3333333333333333333,2,1,2,3,1) : *… |
CVE-2024-47831 | Medium | 5.9 | 2024-10-14 | Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image… |
CVE-2024-31228 | Medium | 5.5 | 2024-10-07 | Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string… |
CVE-2024-7254 | High | 7.5 | 2024-09-19 | Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the… |
CVE-2024-34158 | High | 7.5 | 2024-09-06 | Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion. |
CVE-2024-44996 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: vsock: fix recursive ->recvmsg calls After a vsock socket has been added to a BPF sockmap… |
CVE-2024-43414 | High | 7.5 | 2024-08-27 | Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph independently, empowerin… |
CVE-2024-42369 | Medium | 4.1 | 2024-08-20 | matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predeces… |
CVE-2024-44073 | High | 7.5 | 2024-08-19 | The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth. |
CVE-2024-7866 | Medium | 5.5 | 2024-08-15 | In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack overflow. |
CVE-2024-37973 | High | 8.8 | 2024-07-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2024-5971 | High | 7.5 | 2024-07-08 | A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client woul… |
CVE-2024-2965 | Medium | 4.7 | 2024-06-06 | A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_site… |
CVE-2021-47465 | Medium | 5.5 | 2024-05-22 | In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() In commit 10d91611f426… |
CVE-2023-52761 | High | 7.8 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: riscv: VMAP_STACK overflow detection thread-safe commit 31da94c25aea ("riscv: add VMAP_ST… |
CVE-2024-35886 | High | 7.8 | 2024-05-19 | In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6_dump_done(). syzkaller reported infinite recursive c… |
CVE-2024-32609 | High | 7.5 | 2024-05-14 | HDF5 Library through 1.14.3 allows stack consumption in the function H5E_printf_stack in H5Eint.c. |
CVE-2024-4568 | Low | 2.9 | 2024-05-06 | In Xpdf 4.05 (and earlier), a PDF object loop in the PDF resources leads to infinite recursion and a stack overflow. |
CVE-2024-4340 | High | 7.5 | 2024-04-30 | Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError. |
CVE-2024-3248 | Low | 2.9 | 2024-04-02 | In Xpdf 4.05 (and earlier), a PDF object loop in the attachments leads to infinite recursion and a stack overflow. |
CVE-2024-3247 | Low | 2.9 | 2024-04-02 | In Xpdf 4.05 (and earlier), a PDF object loop in an object stream leads to infinite recursion and a stack overflow. |
CVE-2023-51803 | Critical | 9.8 | 2024-04-01 | LinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "<?php ?>" substring. |
CVE-2024-29904 | High | 7.5 | 2024-03-29 | CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by… |
CVE-2024-20311 | High | 8.6 | 2024-03-27 | A vulnerability in the Locator ID Separation Protocol (LISP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote att… |
CVE-2024-28244 | Medium | 6.5 | 2024-03-25 | KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input usin… |
CVE-2024-28243 | Medium | 6.5 | 2024-03-25 | KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input usin… |
CVE-2024-25111 | High | 8.6 | 2024-03-06 | Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked dec… |
CVE-2024-1899 | Medium | 5.3 | 2024-02-26 | An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions. |
CVE-2024-27454 | High | 7.5 | 2024-02-26 | orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents. |
CVE-2024-25112 | Medium | 5.5 | 2024-02-12 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A denial-of-service was found in Exi… |
CVE-2024-0210 | High | 7.8 | 2024-01-03 | Zigbee TLV dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file |
CVE-2023-52079 | Medium | 6.8 | 2023-12-28 | msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck thr… |
CVE-2023-50269 | High | 8.6 | 2023-12-14 | Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 th… |
CVE-2023-50262 | Medium | 5.3 | 2023-12-13 | Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One… |
CVE-2023-50251 | Medium | 5.3 | 2023-12-12 | php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an at… |
CVE-2022-47374 | High | 7.5 | 2023-12-12 | A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7… |
CVE-2023-49800 | High | 7.5 | 2023-12-09 | `nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on w… |
CVE-2023-47163 | High | 7.5 | 2023-11-13 | Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may ca… |
CVE-2023-31794 | Medium | 5.5 | 2023-10-31 | MuPDF v1.21.1 was discovered to contain an infinite recursion in the component pdf_mark_list_push. This vulnerability allows attackers to cause a Denial of Ser… |
CVE-2023-4512 | Medium | 5.3 | 2023-08-24 | CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file |
CVE-2022-48545 | Medium | 5.5 | 2023-08-22 | An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02. |
CVE-2020-23804 | High | 7.5 | 2023-08-22 | Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input. |
CVE-2023-36632 | High | 7.5 | 2023-06-25 | The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling… |
CVE-2023-2990 | High | 7.5 | 2023-06-22 | Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause… |
CVE-2023-31893 | High | 7.5 | 2023-06-05 | Telefnica Brasil Vivo Play (IPTV) Firmware: 2023.04.04.01.06.15 is vulnerable to Denial of Service (DoS) via DNS Recursion. |
CVE-2023-2664 | Low | 2.9 | 2023-05-11 | In Xpdf 4.04 (and earlier), a PDF object loop in the embedded file tree leads to infinite recursion and a stack overflow. |
CVE-2023-2663 | Low | 2.9 | 2023-05-11 | In Xpdf 4.04 (and earlier), a PDF object loop in the page label tree leads to infinite recursion and a stack overflow. |
CVE-2023-24472 | High | 7.5 | 2023-03-30 | A denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted ImageOutput… |
CVE-2020-36691 | Medium | 5.5 | 2023-03-24 | An issue was discovered in the Linux kernel before 5.8. lib/nlattr.c allows attackers to cause a denial of service (unbounded recursion) via a nested Netlink p… |
CVE-2023-1436 | Medium | 5.9 | 2023-03-22 | An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This lead… |
CVE-2023-1370 | High | 7.5 | 2023-03-22 | [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the… |
CVE-2021-36395 | High | 7.5 | 2023-03-06 | In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service. |
CVE-2022-37034 | Medium | 5.3 | 2023-02-01 | In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large file. If done repeatedl… |
CVE-2023-22617 | High | 7.5 | 2023-01-21 | A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misconfigured domain, be… |
CVE-2022-47662 | Medium | 5.5 | 2023-01-05 | GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 has a segment fault (/stack overflow) due to infinite recursion in Media_GetSample isomedia/media.c:662 |
CVE-2022-41966 | High | 8.2 | 2022-12-28 | XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow… |
CVE-2022-23516 | High | 7.5 | 2022-12-14 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recurs… |
CVE-2022-23500 | Medium | 5.9 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing… |
CVE-2022-41881 | Medium | 5.3 | 2022-12-12 | Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing… |
CVE-2022-46405 | High | 7.5 | 2022-12-04 | Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accoun… |
CVE-2022-42321 | Medium | 6.5 | 2022-11-01 | Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some Xenstore operations (e.g. for deleting a sub-tree of Xensto… |
CVE-2022-27810 | High | 7.5 | 2022-10-06 | It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was… |
CVE-2022-31628 | Low | 2.3 | 2022-09-28 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop. |
CVE-2022-28201 | Medium | 4.4 | 2022-09-19 | An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinit… |
CVE-2022-40150 | Medium | 6.5 | 2022-09-16 | Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input… |
CVE-2022-38334 | Medium | 5.5 | 2022-09-15 | XPDF v4.04 and earlier was discovered to contain a stack overflow via the function Catalog::countPageTree() at Catalog.cc. |