CWE-674 · Uncontrolled Recursion (page 5)
Page 5 of 5 — CVEs classified under CWE-674, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-10089 | High | 7.5 | 2020-03-13 | GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother, |
CVE-2019-20395 | Medium | 6.5 | 2020-01-22 | A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to par… |
CVE-2019-20334 | Medium | 5.5 | 2020-01-04 | In Netwide Assembler (NASM) 2.14.02, stack consumption occurs in expr# functions in asm/eval.c. This potentially affects the relationships among expr0, expr1… |
CVE-2019-20198 | Medium | 6.5 | 2019-12-31 | An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_ent_ok() mishandles recursion, leading to stack consumption for a crafted XML file. |
CVE-2019-19645 | Medium | 5.5 | 2019-12-09 | alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE sta… |
CVE-2019-11937 | High | 7.5 | 2019-12-04 | In Mcrouter prior to v0.41.0, a large struct input provided to the Carbon protocol reader could result in stack exhaustion and denial of service. |
CVE-2019-18854 | High | 7.5 | 2019-11-11 | A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ... xlin… |
CVE-2019-18853 | Medium | 6.5 | 2019-11-11 | ImageMagick before 7.0.9-0 allows remote attackers to cause a denial of service because XML_PARSE_HUGE is not properly restricted in coders/svg.c, related to S… |
CVE-2019-18797 | Medium | 6.5 | 2019-11-06 | LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operator()(Sass::Binary_Expression*) in eval.cpp. |
CVE-2018-4002 | High | 7.5 | 2019-10-31 | An exploitable denial-of-service vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. When parsing labels in mDNS packe… |
CVE-2019-17450 | Medium | 6.5 | 2019-10-10 | find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to ca… |
CVE-2018-16452 | High | 7.5 | 2019-10-03 | The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion. |
CVE-2018-16300 | High | 7.5 | 2019-10-03 | The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited recursion. |
CVE-2019-13124 | High | 7.5 | 2019-09-30 | Foxit Reader 9.6.0.25114 and earlier has two unique RecursiveCall bugs involving 3 functions exhausting available stack memory because of Uncontrolled Recursio… |
CVE-2019-13123 | High | 7.5 | 2019-09-30 | Foxit Reader 9.6.0.25114 and earlier has two unique RecursiveCall bugs involving 3 functions exhausting available stack memory because of Uncontrolled Recursio… |
CVE-2019-11779 | Medium | 6.5 | 2019-09-19 | In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or m… |
CVE-2019-16163 | High | 7.5 | 2019-09-09 | Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. |
CVE-2019-16088 | Medium | 5.5 | 2019-09-06 | Xpdf 3.04 has a SIGSEGV in XRef::fetch in XRef.cc after many recursive calls to Catalog::countPageTree in Catalog.cc. |
CVE-2019-15542 | High | 7.5 | 2019-08-26 | An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization. |
CVE-2018-20994 | High | 7.5 | 2019-08-26 | An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled. |
CVE-2018-20993 | High | 7.5 | 2019-08-26 | An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization. |
CVE-2019-15144 | Medium | 5.5 | 2019-08-18 | In DjVuLibre 3.5.27, the sorting functionality (aka GArrayTemplate<TYPE>::sort) allows attackers to cause a denial-of-service (application crash due to an Unco… |
CVE-2019-15118 | Medium | 5.5 | 2019-08-16 | check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion. |
CVE-2019-14235 | High | 7.5 | 2019-08-02 | An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_ir… |
CVE-2019-13103 | High | 7.1 | 2019-07-29 | A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinite… |
CVE-2019-13955 | Medium | 6.5 | 2019-07-26 | Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticated remote attacker… |
CVE-2019-1010182 | Medium | 6.5 | 2019-07-25 | yaml-rust 0.4.0 and earlier is affected by: Uncontrolled Recursion. The impact is: Denial of service by impossible to catch abort. The component is: YamlLoader… |
CVE-2019-1010183 | Medium | 6.5 | 2019-07-25 | serde serde_yaml 0.6.0 to 0.8.3 is affected by: Uncontrolled Recursion. The impact is: Denial of service by aborting. The component is: from_* functions (all d… |
CVE-2019-13288 | Medium | 5.5 | 2019-07-04 | In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS atta… |
CVE-2019-13129 | High | 7.5 | 2019-07-01 | On the Motorola router CX2L MWR04L 1.01, there is a stack consumption (infinite recursion) issue in scopd via TCP port 8010 and UDP port 8080. It is caused by… |
CVE-2019-12295 | High | 7.5 | 2019-05-23 | In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the num… |
CVE-2019-12213 | Medium | 6.5 | 2019-05-20 | When FreeImage 3.18.0 reads a special TIFF file, the TIFFReadDirectory function in PluginTIFF.cpp always returns 1, leading to stack exhaustion. |
CVE-2019-12212 | High | 7.5 | 2019-05-20 | When FreeImage 3.18.0 reads a special JXR file, the StreamCalcIFDSize function of JXRMeta.c repeatedly calls itself due to improper processing of the file, eve… |
CVE-2018-20822 | Medium | 6.5 | 2019-04-23 | LibSass 3.5.4 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Complex_Selector::perform in ast.hpp and Sass::Inspect::operator i… |
CVE-2018-20821 | Medium | 6.5 | 2019-04-23 | The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Parser::parse_css_variable_value… |
CVE-2019-11413 | High | 7.5 | 2019-04-22 | An issue was discovered in Artifex MuJS 1.0.5. It has unlimited recursion because the match function in regexp.c lacks a depth check. |
CVE-2019-11026 | Medium | 6.5 | 2019-04-08 | FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc. |
CVE-2019-11024 | Medium | 5.5 | 2019-04-08 | The load_pnm function in frompnm.c in libsixel.a in libsixel 1.8.2 has infinite recursion. |
CVE-2019-9904 | Medium | 6.5 | 2019-03-21 | An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphviz 2.40.1. Stack consumption occurs because of recursive agclose calls in lib\cgraph\graph.c i… |
CVE-2019-9545 | High | 8.8 | 2019-03-01 | An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a… |
CVE-2019-9543 | High | 8.8 | 2019-03-01 | An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sendin… |
CVE-2019-9192 | High | 7.5 | 2019-02-26 | In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\1\… |
CVE-2018-20796 | High | 7.5 | 2019-02-26 | In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(… |
CVE-2019-9144 | High | 8.8 | 2019-02-25 | An issue was discovered in Exiv2 0.27. There is infinite recursion at BigTiffImage::printIFD in the file bigtiffimage.cpp. This can be triggered by a crafted f… |
CVE-2019-9143 | High | 8.8 | 2019-02-25 | An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file image.cpp. This can be triggered by a crafte… |
CVE-2019-9071 | Medium | 5.5 | 2019-02-24 | An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. It is a stack consumption issue in d_count_templates_scopes in cp-demangle.c aft… |
CVE-2019-1003011 | High | 8.1 | 2019-02-06 | An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenma… |
CVE-2019-0001 | High | 7.5 | 2019-01-15 | Receipt of a malformed packet on MX Series devices with dynamic vlan configuration can trigger an uncontrolled recursion loop in the Broadband Edge subscriber… |
CVE-2019-6293 | Medium | 5.5 | 2019-01-15 | An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the mark_beginning_as_no… |
CVE-2019-6292 | Medium | 6.5 | 2019-01-15 | An issue was discovered in singledocparser.cpp in yaml-cpp (aka LibYaml-C++) 0.6.2. Stack Exhaustion occurs in YAML::SingleDocParser, and there is a stack cons… |
CVE-2019-6291 | Medium | 5.5 | 2019-01-15 | An issue was discovered in the function expr6 in eval.c in Netwide Assembler (NASM) through 2.14.02. There is a stack exhaustion problem caused by the expr6 fu… |
CVE-2019-6290 | Medium | 5.5 | 2019-01-15 | An infinite recursion issue was discovered in eval.c in Netwide Assembler (NASM) through 2.14.02. There is a stack exhaustion problem resulting from infinite r… |
CVE-2019-6285 | Medium | 6.5 | 2019-01-14 | The SingleDocParser::HandleFlowSequence function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption an… |
CVE-2019-6131 | Medium | 5.5 | 2019-01-11 | svg-run.c in Artifex MuPDF 1.14.0 has infinite recursion with stack consumption in svg_run_use_symbol, svg_run_element, and svg_run_use, as demonstrated by mut… |
CVE-2018-18484 | Medium | 5.5 | 2018-10-18 | An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. Stack Exhaustion occurs in the C++ demangling functions provide… |
CVE-2018-18020 | Low | 3.3 | 2018-10-06 | In QPDF 8.2.1, in libqpdf/QPDFWriter.cc, QPDFWriter::unparseObject and QPDFWriter::unparseChild have recursive calls for a long time, which allows remote attac… |
CVE-2018-16426 | Medium | 4.3 | 2018-09-04 | Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by at… |
CVE-2018-1158 | Medium | 6.5 | 2018-08-23 | Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via re… |
CVE-2016-9597 | High | 7.5 | 2018-07-30 | It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found in libxml2, making… |
CVE-2018-1000618 | Critical | 9.8 | 2018-07-09 | EOSIO/eos eos version after commit f1545dd0ae2b77580c2236fdb70ae7138d2c7168 contains a stack overflow vulnerability in abi_serializer that can result in attack… |
CVE-2018-11597 | Medium | 5.5 | 2018-05-31 | Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via a Buffer Overflow during syntax parsi… |
CVE-2018-11254 | Medium | 5.5 | 2018-05-18 | An issue was discovered in PoDoFo 0.9.5. There is an Excessive Recursion in the PdfPagesTree::GetPageNode() function of PdfPagesTree.cpp. Remote attackers coul… |
CVE-2018-8015 | High | 7.5 | 2018-05-18 | In Apache ORC 1.0.0 to 1.4.3 a malformed ORC file can trigger an endlessly recursive function call in the C++ or Java parser. The impact of this bug is most li… |
CVE-2018-9996 | Medium | 5.5 | 2018-04-10 | An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided… |
CVE-2018-9918 | High | 7.8 | 2018-04-10 | libqpdf.a in QPDF through 8.0.2 mishandles certain "expected dictionary key but found non-name object" cases, allowing remote attackers to cause a denial of se… |
CVE-2018-9138 | Medium | 5.5 | 2018-03-30 | An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30. Stack Exhaustion occurs in the C++ demangling functions… |
CVE-2018-0739 | Medium | 6.5 | 2018-03-27 | Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recu… |
CVE-2018-6544 | Medium | 5.5 | 2018-02-02 | pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows rem… |
CVE-2018-5759 | Medium | 5.5 | 2018-01-24 | jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows remote attackers to cause a denial of ser… |
CVE-2018-6003 | High | 7.5 | 2018-01-22 | An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stac… |
CVE-2016-10707 | High | 7.5 | 2018-01-18 | jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased na… |
CVE-2018-5772 | Medium | 5.5 | 2018-01-18 | In Exiv2 0.26, there is a segmentation fault caused by uncontrolled recursion in the Exiv2::Image::printIFDStructure function in the image.cpp file. Remote att… |
CVE-2017-10910 | Medium | 6.5 | 2017-12-28 | MQTT.js 2.x.x prior to 2.15.0 issue in handling PUBLISH tickets may lead to an attacker causing a denial-of-service condition. |
CVE-2017-16419 | Medium | 6.5 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-14861 | Medium | 5.5 | 2017-09-29 | There is a stack consumption vulnerability in the Exiv2::Internal::stringFormat function of image.cpp in Exiv2 0.26. A Crafted input will lead to a remote deni… |
CVE-2017-12964 | High | 7.5 | 2017-08-18 | There is a stack consumption issue in LibSass 3.4.5 that is triggered in the function Sass::Eval::operator() in eval.cpp. It will lead to a remote denial of se… |
CVE-2017-11556 | High | 7.5 | 2017-07-23 | There is a stack consumption vulnerability in the Parser::advanceToNextToken function in parser.cpp in LibSass 3.4.5. A crafted input may lead to remote denial… |
CVE-2017-11554 | High | 7.5 | 2017-07-23 | There is a stack consumption vulnerability in the lex function in parser.hpp (as used in sassc) in LibSass 3.4.5. A crafted input will lead to a remote denial… |
CVE-2017-11164 | High | 7.5 | 2017-07-11 | In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular ex… |
CVE-2017-0692 | Medium | 5.5 | 2017-07-06 | A denial of service vulnerability in the Android media framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A… |
CVE-2017-9766 | High | 7.5 | 2017-06-21 | In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in the dissect_IODWrit… |
CVE-2017-9729 | High | 7.5 | 2017-06-16 | In uClibc 0.9.33.2, there is stack exhaustion (uncontrolled recursion) in the check_dst_limits_calc_pos_1 function in misc/regex/regexec.c when processing a cr… |
CVE-2017-9617 | Medium | 5.5 | 2017-06-14 | In Wireshark 2.2.7, deeply nested DAAP data may cause stack exhaustion (uncontrolled recursion) in the dissect_daap_one_tag function in epan/dissectors/packet-… |
CVE-2017-9616 | Medium | 5.5 | 2017-06-14 | In Wireshark 2.2.7, overly deep mp4 chunks may cause stack exhaustion (uncontrolled recursion) in the dissect_mp4_box function in epan/dissectors/file-mp4.c. |
CVE-2017-7515 | Medium | 5.5 | 2017-06-06 | poppler through version 0.55.0 is vulnerable to an uncontrolled recursion in pdfunite resulting into potential denial-of-service. |
CVE-2017-9438 | High | 7.5 | 2017-06-05 | libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex stri… |
CVE-2017-9304 | High | 7.5 | 2017-05-31 | libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled… |
CVE-2017-8542 | Medium | 5.5 | 2017-05-26 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W… |
CVE-2017-8539 | Medium | 5.5 | 2017-05-26 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W… |
CVE-2017-8537 | Medium | 5.5 | 2017-05-26 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W… |
CVE-2017-8536 | Medium | 5.5 | 2017-05-26 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W… |
CVE-2017-8535 | Medium | 5.5 | 2017-05-26 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W… |
CVE-2017-0886 | Medium | 6.5 | 2017-04-05 | Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Denial of Service attack. Due to an error in the application logic an authenticated adversary may trig… |
CVE-2017-5839 | High | 7.5 | 2017-02-09 | The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, whi… |
CVE-2016-4425 | Medium | 6.5 | 2016-05-17 | Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data. |
CVE-2016-3627 | High | 7.5 | 2016-05-17 | The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of s… |
CVE-2007-3409 | High | 7.5 | 2007-06-26 | Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-r… |
CVE-2007-1285 | High | 7.5 | 2007-03-06 | The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply… |