CWE-674 · Uncontrolled Recursion (page 5)
Page 5 of 6 — CVEs classified under CWE-674, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-23606 | Medium | 4.4 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle… |
CVE-2022-25313 | Medium | 6.5 | 2022-02-18 | In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. |
CVE-2022-23591 | High | 7.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. The `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that… |
CVE-2022-23889 | Medium | 5.3 | 2022-01-28 | The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comment… |
CVE-2021-46509 | High | 7.8 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a stack overflow via snquote at mjs/src/mjs_json.c. |
CVE-2021-46507 | Medium | 5.5 | 2022-01-27 | Jsish v3.5.0 was discovered to contain a stack overflow via Jsi_LogMsg at src/jsiUtils.c. |
CVE-2021-46505 | Medium | 5.5 | 2022-01-27 | Jsish v3.5.0 was discovered to contain a stack overflow via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x5b1e5. |
CVE-2022-21708 | Medium | 6.5 | 2022-01-21 | graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the li… |
CVE-2021-46195 | Medium | 5.5 | 2022-01-14 | GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denia… |
CVE-2021-45832 | Medium | 5.5 | 2022-01-05 | A Stack-based Buffer Overflow Vulnerability exists in HDF5 1.13.1-1 at at hdf5/src/H5Eint.c, which causes a Denial of Service (context-dependent). |
CVE-2021-45105 | Medium | 5.9 | 2021-12-18 | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This a… |
CVE-2021-42717 | High | 7.5 | 2021-12-07 | ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web serv… |
CVE-2021-39929 | High | 7.5 | 2021-11-19 | Uncontrolled Recursion in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted… |
CVE-2021-43172 | High | 7.5 | 2021-11-09 | NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. In RPKI, a… |
CVE-2021-43519 | Medium | 5.5 | 2021-11-09 | Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file. |
CVE-2021-42697 | High | 7.5 | 2021-11-02 | Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a… |
CVE-2021-39257 | Medium | 5.5 | 2021-09-07 | A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite), causing stack consumption… |
CVE-2020-18898 | Medium | 6.5 | 2021-08-19 | A stack exhaustion issue in the printIFDStructure function of Exiv2 0.27 allows remote attackers to cause a denial of service (DOS) via a crafted file. |
CVE-2021-38569 | High | 7.5 | 2021-08-11 | An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows stack consumption via recursive function calls during the handling of XFA forms… |
CVE-2021-38566 | High | 7.5 | 2021-08-11 | An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows stack consumption during recursive processing of embedded XML… |
CVE-2021-22144 | Medium | 6.5 | 2021-07-26 | In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the… |
CVE-2021-36773 | High | 7.5 | 2021-07-18 | uBlock Origin before 1.36.2 and nMatrix before 4.4.9 support an arbitrary depth of parameter nesting for strict blocking, which allows crafted web sites to cau… |
CVE-2021-36154 | High | 7.5 | 2021-07-09 | HTTP2ToRawGRPCServerCodec in gRPC Swift 1.1.1 and earlier allows remote attackers to deny service via the delivery of many small messages within a single HTTP/… |
CVE-2020-20213 | Medium | 6.5 | 2021-07-07 | Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an stack exhaustion vulnerability in the /nova/bin/net process. An authenticated remote attacker can cau… |
CVE-2021-28210 | High | 7.8 | 2021-06-11 | An unlimited recursion in DxeCore in EDK II. |
CVE-2021-3530 | High | 7.5 | 2021-06-02 | A flaw was discovered in GNU libiberty within demangle_path() in rust-demangle.c, as distributed in GNU Binutils version 2.36. A crafted symbol can cause stack… |
CVE-2020-36375 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_equality Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36374 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_comparison Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36373 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_shifts Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36372 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_plus_minus Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36371 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_mul_div_rem Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36370 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_unary Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36369 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_statement_list Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36368 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_statement Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36367 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_block Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-36366 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_value Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2020-18392 | Medium | 5.5 | 2021-05-28 | Stack overflow vulnerability in parse_array Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted file. |
CVE-2021-31525 | Medium | 5.9 | 2021-05-27 | net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadRe… |
CVE-2021-30471 | Medium | 5.5 | 2021-05-26 | A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call in PdfNamesTree::AddToDictionary function in src/podofo/doc/PdfNamesTree.cpp can lead to a sta… |
CVE-2021-30470 | Medium | 5.5 | 2021-05-26 | A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call among PdfTokenizer::ReadArray(), PdfTokenizer::GetNextVariant() and PdfTokenizer::ReadDataType… |
CVE-2021-28903 | High | 7.5 | 2021-05-20 | A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_elem() function will be called recursivel… |
CVE-2021-27432 | High | 7.5 | 2021-05-20 | OPC Foundation UA .NET Standard versions prior to 1.4.365.48 and OPC UA .NET Legacy are vulnerable to an uncontrolled recursion, which may allow an attacker to… |
CVE-2021-27434 | High | 7.5 | 2021-05-20 | Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior (.NET 4.5, 4.0, and 3.5 Framework versions only) are vul… |
CVE-2021-29615 | Low | 2.5 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. The implementation of `ParseAttrValue`(https://github.com/tensorflow/tensorflow/blob/c22… |
CVE-2021-29591 | High | 7.3 | 2021-05-14 | TensorFlow is an end-to-end open source platform for machine learning. TFlite graphs must not have loops between nodes. However, this condition was not checked… |
CVE-2021-21359 | Medium | 5.9 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources… |
CVE-2020-1898 | High | 7.5 | 2021-03-11 | The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to… |
CVE-2021-20255 | Medium | 5.5 | 2021-03-09 | A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while processing controlle… |
CVE-2021-28040 | High | 7.5 | 2021-03-05 | An issue was discovered in OSSEC 3.6.0. An uncontrolled recursion vulnerability in os_xml.c occurs when a large number of opening and closing XML tags is used… |
CVE-2020-29566 | Medium | 5.5 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. When they require assistance from the device model, x86 HVM guests must be temporarily de-scheduled. The device… |
CVE-2020-8285 | High | 7.5 | 2020-12-14 | curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing. |
CVE-2020-26883 | High | 7.5 | 2020-11-06 | In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents. |
CVE-2020-26882 | High | 7.5 | 2020-11-06 | In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input. |
CVE-2020-28196 | High | 7.5 | 2020-11-06 | MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/as… |
CVE-2020-28242 | Medium | 6.5 | 2020-11-06 | An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk bef… |
CVE-2020-9861 | High | 7.5 | 2020-11-02 | A stack overflow issue existed in Swift for Linux. The issue was addressed with improved input validation for dealing with deeply nested malicious JSON input. |
CVE-2020-25219 | High | 7.5 | 2020-09-09 | url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response composed of an infinite… |
CVE-2020-12100 | High | 7.5 | 2020-08-12 | In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via… |
CVE-2020-9243 | Medium | 5.5 | 2020-08-10 | HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a denial of service vulnerability. The system does not properly limit the depth of recur… |
CVE-2020-16094 | High | 7.5 | 2020-07-28 | In imap_scan_tree_recursive in Claws Mail through 3.17.6, a malicious IMAP server can trigger stack consumption because of unlimited recursion into subdirector… |
CVE-2020-15101 | Low | 2.8 | 2020-07-14 | In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk()… |
CVE-2020-5591 | High | 7.5 | 2020-06-05 | XACK DNS 1.11.0 to 1.11.4, 1.10.0 to 1.10.8, 1.8.0 to 1.8.23, 1.7.0 to 1.7.18, and versions before 1.7.0 allow remote attackers to cause a denial of service co… |
CVE-2020-13800 | Medium | 6.0 | 2020-06-04 | ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_writ… |
CVE-2019-20819 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It allows stack consumption via nested function calls for XML parsing. |
CVE-2019-20815 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.12. It allows stack consumption via nested function calls for XML parsing. |
CVE-2020-13164 | High | 7.5 | 2020-05-19 | In Wireshark 3.2.0 to 3.2.3, 3.0.0 to 3.0.10, and 2.6.0 to 2.6.16, the NFS dissector could crash. This was addressed in epan/dissectors/packet-nfs.c by prevent… |
CVE-2020-12825 | High | 7.1 | 2020-05-12 | libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption. |
CVE-2020-10704 | High | 7.5 | 2020-05-06 | A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Control… |
CVE-2018-21232 | Medium | 5.5 | 2020-04-29 | re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags. |
CVE-2020-12243 | High | 7.5 | 2020-04-28 | In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash). |
CVE-2019-8961 | High | 7.5 | 2020-04-21 | A Denial of Service vulnerability related to stack exhaustion has been identified in FlexNet Publisher lmadmin.exe 11.16.2. Because the message reading functio… |
CVE-2020-11647 | High | 7.5 | 2020-04-10 | In Wireshark 3.2.0 to 3.2.2, 3.0.0 to 3.0.9, and 2.6.0 to 2.6.15, the BACapp dissector could crash. This was addressed in epan/dissectors/packet-bacapp.c by li… |
CVE-2020-6071 | High | 7.5 | 2020-03-24 | An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labe… |
CVE-2019-18936 | High | 7.5 | 2020-03-21 | UniValue::read() in UniValue before 1.0.5 allow attackers to cause a denial of service (the class internal data reaches an inconsistent state) via input data t… |
CVE-2020-10089 | High | 7.5 | 2020-03-13 | GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother, |
CVE-2019-20395 | Medium | 6.5 | 2020-01-22 | A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to par… |
CVE-2019-20334 | Medium | 5.5 | 2020-01-04 | In Netwide Assembler (NASM) 2.14.02, stack consumption occurs in expr# functions in asm/eval.c. This potentially affects the relationships among expr0, expr1… |
CVE-2019-20198 | Medium | 6.5 | 2019-12-31 | An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_ent_ok() mishandles recursion, leading to stack consumption for a crafted XML file. |
CVE-2019-19645 | Medium | 5.5 | 2019-12-09 | alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE sta… |
CVE-2019-11937 | High | 7.5 | 2019-12-04 | In Mcrouter prior to v0.41.0, a large struct input provided to the Carbon protocol reader could result in stack exhaustion and denial of service. |
CVE-2019-18854 | High | 7.5 | 2019-11-11 | A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ... xlin… |
CVE-2019-18853 | Medium | 6.5 | 2019-11-11 | ImageMagick before 7.0.9-0 allows remote attackers to cause a denial of service because XML_PARSE_HUGE is not properly restricted in coders/svg.c, related to S… |
CVE-2019-18797 | Medium | 6.5 | 2019-11-06 | LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operator()(Sass::Binary_Expression*) in eval.cpp. |
CVE-2018-4002 | High | 7.5 | 2019-10-31 | An exploitable denial-of-service vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. When parsing labels in mDNS packe… |
CVE-2019-17450 | Medium | 6.5 | 2019-10-10 | find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to ca… |
CVE-2018-16452 | High | 7.5 | 2019-10-03 | The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion. |
CVE-2018-16300 | High | 7.5 | 2019-10-03 | The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited recursion. |
CVE-2019-13124 | High | 7.5 | 2019-09-30 | Foxit Reader 9.6.0.25114 and earlier has two unique RecursiveCall bugs involving 3 functions exhausting available stack memory because of Uncontrolled Recursio… |
CVE-2019-13123 | High | 7.5 | 2019-09-30 | Foxit Reader 9.6.0.25114 and earlier has two unique RecursiveCall bugs involving 3 functions exhausting available stack memory because of Uncontrolled Recursio… |
CVE-2019-11779 | Medium | 6.5 | 2019-09-19 | In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or m… |
CVE-2019-16163 | High | 7.5 | 2019-09-09 | Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. |
CVE-2019-16088 | Medium | 5.5 | 2019-09-06 | Xpdf 3.04 has a SIGSEGV in XRef::fetch in XRef.cc after many recursive calls to Catalog::countPageTree in Catalog.cc. |
CVE-2019-15542 | High | 7.5 | 2019-08-26 | An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization. |
CVE-2018-20994 | High | 7.5 | 2019-08-26 | An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled. |
CVE-2018-20993 | High | 7.5 | 2019-08-26 | An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization. |
CVE-2019-15144 | Medium | 5.5 | 2019-08-18 | In DjVuLibre 3.5.27, the sorting functionality (aka GArrayTemplate<TYPE>::sort) allows attackers to cause a denial-of-service (application crash due to an Unco… |
CVE-2019-15118 | Medium | 5.5 | 2019-08-16 | check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion. |
CVE-2019-14235 | High | 7.5 | 2019-08-02 | An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_ir… |
CVE-2019-13103 | High | 7.1 | 2019-07-29 | A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinite… |
CVE-2019-13955 | Medium | 6.5 | 2019-07-26 | Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticated remote attacker… |