CWE-674 · Uncontrolled Recursion (page 4)
Page 4 of 6 — CVEs classified under CWE-674, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-58102 | Medium | 5.7 | 2025-03-11 | An issue was discovered in Datalust Seq before 2024.3.13545. An insecure default parsing depth limit allows stack consumption when parsing user-supplied querie… |
CVE-2025-1492 | High | 7.8 | 2025-02-20 | Bundle Protocol and CBOR dissector crashes in Wireshark 4.4.0 to 4.4.3 and 4.2.0 to 4.2.10 allows denial of service via packet injection or crafted capture file |
CVE-2024-57257 | Low | 2.0 | 2025-02-18 | A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting. |
CVE-2024-57699 | High | 7.5 | 2025-02-05 | A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack ex… |
CVE-2024-54731 | Medium | 4.0 | 2025-01-08 | cpdf through 2.8 allows stack consumption via a crafted PDF document. |
CVE-2024-49363 | High | 7.4 | 2024-12-18 | Misskey is an open source, federated social media platform. In affected versions FileServerService (media proxy) in github.com/misskey-dev/misskey 2024.10.1 or… |
CVE-2023-29001 | High | 7.5 | 2024-11-27 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. The Contiki-NG operating system processes source routing headers (SRH) in its tw… |
CVE-2024-53090 | High | 7.5 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix lock recursion afs_wake_up_async_call() can incur lock recursion. The problem i… |
CVE-2021-41737 | High | 7.5 | 2024-11-10 | In Faust 2.23.1, an input file with the lines "// r visualisation tCst" and "//process = +: L: abM-^Q;" and "process = route(3333333333333333333,2,1,2,3,1) : *… |
CVE-2024-47831 | Medium | 5.9 | 2024-10-14 | Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image… |
CVE-2024-31228 | Medium | 5.5 | 2024-10-07 | Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string… |
CVE-2024-7254 | High | 7.5 | 2024-09-19 | Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the… |
CVE-2024-34158 | High | 7.5 | 2024-09-06 | Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion. |
CVE-2024-44996 | Medium | 5.5 | 2024-09-04 | In the Linux kernel, the following vulnerability has been resolved: vsock: fix recursive ->recvmsg calls After a vsock socket has been added to a BPF sockmap… |
CVE-2024-43414 | High | 7.5 | 2024-08-27 | Apollo Federation is an architecture for declaratively composing APIs into a unified graph. Each team can own their slice of the graph independently, empowerin… |
CVE-2024-42369 | Medium | 4.1 | 2024-08-20 | matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predeces… |
CVE-2024-44073 | High | 7.5 | 2024-08-19 | The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth. |
CVE-2024-7866 | Medium | 5.5 | 2024-08-15 | In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack overflow. |
CVE-2024-37973 | High | 8.8 | 2024-07-09 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2024-5971 | High | 7.5 | 2024-07-08 | A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client woul… |
CVE-2024-2965 | Medium | 4.7 | 2024-06-06 | A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_site… |
CVE-2021-47465 | Medium | 5.5 | 2024-05-22 | In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() In commit 10d91611f426… |
CVE-2023-52761 | High | 7.8 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: riscv: VMAP_STACK overflow detection thread-safe commit 31da94c25aea ("riscv: add VMAP_ST… |
CVE-2024-35886 | High | 7.8 | 2024-05-19 | In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6_dump_done(). syzkaller reported infinite recursive c… |
CVE-2024-32609 | High | 7.5 | 2024-05-14 | HDF5 Library through 1.14.3 allows stack consumption in the function H5E_printf_stack in H5Eint.c. |
CVE-2024-4568 | Low | 2.9 | 2024-05-06 | In Xpdf 4.05 (and earlier), a PDF object loop in the PDF resources leads to infinite recursion and a stack overflow. |
CVE-2024-4340 | High | 7.5 | 2024-04-30 | Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError. |
CVE-2024-3248 | Low | 2.9 | 2024-04-02 | In Xpdf 4.05 (and earlier), a PDF object loop in the attachments leads to infinite recursion and a stack overflow. |
CVE-2024-3247 | Low | 2.9 | 2024-04-02 | In Xpdf 4.05 (and earlier), a PDF object loop in an object stream leads to infinite recursion and a stack overflow. |
CVE-2023-51803 | Critical | 9.8 | 2024-04-01 | LinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "<?php ?>" substring. |
CVE-2024-29904 | High | 7.5 | 2024-03-29 | CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by… |
CVE-2024-20311 | High | 8.6 | 2024-03-27 | A vulnerability in the Locator ID Separation Protocol (LISP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote att… |
CVE-2024-28244 | Medium | 6.5 | 2024-03-25 | KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input usin… |
CVE-2024-28243 | Medium | 6.5 | 2024-03-25 | KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input usin… |
CVE-2024-25111 | High | 8.6 | 2024-03-06 | Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked dec… |
CVE-2024-1899 | Medium | 5.3 | 2024-02-26 | An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions. |
CVE-2024-27454 | High | 7.5 | 2024-02-26 | orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents. |
CVE-2024-25112 | Medium | 5.5 | 2024-02-12 | Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A denial-of-service was found in Exi… |
CVE-2024-0210 | High | 7.8 | 2024-01-03 | Zigbee TLV dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file |
CVE-2023-52079 | Medium | 6.8 | 2023-12-28 | msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck thr… |
CVE-2023-50269 | High | 8.6 | 2023-12-14 | Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 th… |
CVE-2023-50262 | Medium | 5.3 | 2023-12-13 | Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One… |
CVE-2023-50251 | Medium | 5.3 | 2023-12-12 | php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an at… |
CVE-2022-47374 | High | 7.5 | 2023-12-12 | A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7… |
CVE-2023-49800 | High | 7.5 | 2023-12-09 | `nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on w… |
CVE-2023-47163 | High | 7.5 | 2023-11-13 | Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may ca… |
CVE-2023-31794 | Medium | 5.5 | 2023-10-31 | MuPDF v1.21.1 was discovered to contain an infinite recursion in the component pdf_mark_list_push. This vulnerability allows attackers to cause a Denial of Ser… |
CVE-2023-4512 | Medium | 5.3 | 2023-08-24 | CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file |
CVE-2022-48545 | Medium | 5.5 | 2023-08-22 | An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02. |
CVE-2020-23804 | High | 7.5 | 2023-08-22 | Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input. |
CVE-2023-36632 | High | 7.5 | 2023-06-25 | The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling… |
CVE-2023-2990 | High | 7.5 | 2023-06-22 | Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause… |
CVE-2023-31893 | High | 7.5 | 2023-06-05 | Telefnica Brasil Vivo Play (IPTV) Firmware: 2023.04.04.01.06.15 is vulnerable to Denial of Service (DoS) via DNS Recursion. |
CVE-2023-2664 | Low | 2.9 | 2023-05-11 | In Xpdf 4.04 (and earlier), a PDF object loop in the embedded file tree leads to infinite recursion and a stack overflow. |
CVE-2023-2663 | Low | 2.9 | 2023-05-11 | In Xpdf 4.04 (and earlier), a PDF object loop in the page label tree leads to infinite recursion and a stack overflow. |
CVE-2023-24472 | High | 7.5 | 2023-03-30 | A denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted ImageOutput… |
CVE-2020-36691 | Medium | 5.5 | 2023-03-24 | An issue was discovered in the Linux kernel before 5.8. lib/nlattr.c allows attackers to cause a denial of service (unbounded recursion) via a nested Netlink p… |
CVE-2023-1436 | Medium | 5.9 | 2023-03-22 | An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This lead… |
CVE-2023-1370 | High | 7.5 | 2023-03-22 | [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the… |
CVE-2021-36395 | High | 7.5 | 2023-03-06 | In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service. |
CVE-2022-37034 | Medium | 5.3 | 2023-02-01 | In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large file. If done repeatedl… |
CVE-2023-22617 | High | 7.5 | 2023-01-21 | A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misconfigured domain, be… |
CVE-2022-47662 | Medium | 5.5 | 2023-01-05 | GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 has a segment fault (/stack overflow) due to infinite recursion in Media_GetSample isomedia/media.c:662 |
CVE-2022-41966 | High | 8.2 | 2022-12-28 | XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow… |
CVE-2022-23516 | High | 7.5 | 2022-12-14 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recurs… |
CVE-2022-23500 | Medium | 5.9 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing… |
CVE-2022-41881 | Medium | 5.3 | 2022-12-12 | Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing… |
CVE-2022-46405 | High | 7.5 | 2022-12-04 | Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accoun… |
CVE-2022-42321 | Medium | 6.5 | 2022-11-01 | Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some Xenstore operations (e.g. for deleting a sub-tree of Xensto… |
CVE-2022-27810 | High | 7.5 | 2022-10-06 | It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was… |
CVE-2022-31628 | Low | 2.3 | 2022-09-28 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop. |
CVE-2022-28201 | Medium | 4.4 | 2022-09-19 | An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinit… |
CVE-2022-40150 | Medium | 6.5 | 2022-09-16 | Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input… |
CVE-2022-38334 | Medium | 5.5 | 2022-09-15 | XPDF v4.04 and earlier was discovered to contain a stack overflow via the function Catalog::countPageTree() at Catalog.cc. |
CVE-2022-3222 | Medium | 5.5 | 2022-09-15 | Uncontrolled Recursion in GitHub repository gpac/gpac prior to 2.1.0-DEV. |
CVE-2022-3216 | Medium | 5.0 | 2022-09-14 | A vulnerability has been found in Nintendo Game Boy Color and classified as problematic. This vulnerability affects unknown code of the component Mobile Adapte… |
CVE-2021-3997 | Medium | 5.5 | 2022-08-23 | A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are cr… |
CVE-2022-23460 | Medium | 5.9 | 2022-08-19 | Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustion in an address san… |
CVE-2022-20382 | Medium | 6.7 | 2022-08-11 | In (TBD) of (TBD), there is a possible out of bounds write due to kernel stack overflow. This could lead to local escalation of privilege with System execution… |
CVE-2022-30635 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a mess… |
CVE-2022-30633 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalli… |
CVE-2022-30632 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containi… |
CVE-2022-30631 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archi… |
CVE-2022-30630 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a… |
CVE-2022-28131 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply… |
CVE-2022-1962 | Medium | 5.5 | 2022-08-10 | Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deepl… |
CVE-2022-37315 | High | 7.5 | 2022-08-01 | graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser. |
CVE-2022-31173 | High | 7.5 | 2022-08-01 | Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue ha… |
CVE-2019-10761 | High | 8.3 | 2022-07-13 | This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the… |
CVE-2022-31052 | Medium | 6.5 | 2022-06-28 | Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the av… |
CVE-2022-31099 | Medium | 6.5 | 2022-06-27 | rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service… |
CVE-2022-31019 | High | 7.5 | 2022-06-09 | Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with… |
CVE-2022-1771 | Medium | 5.5 | 2022-05-18 | Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975. |
CVE-2022-30974 | Medium | 5.5 | 2022-05-18 | compile in regexp.c in Artifex MuJS through 1.2.0 results in stack consumption because of unlimited recursion, a different issue than CVE-2019-11413. |
CVE-2022-24675 | High | 7.5 | 2022-04-20 | encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. |
CVE-2022-28773 | High | 7.5 | 2022-04-12 | Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can… |
CVE-2022-23974 | High | 7.5 | 2022-04-05 | In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow… |
CVE-2021-41752 | Critical | 9.8 | 2022-04-05 | Stack overflow vulnerability in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021 due to an unbounded recursive call to the ne… |
CVE-2022-27943 | Medium | 5.5 | 2022-03-26 | libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new. |
CVE-2022-24921 | High | 7.5 | 2022-03-05 | regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression. |