Uncontrolled Recursion

Every one of the 621 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Apache Log4j2 does not always protect from infinite recursion in lookup evaluationCVE-2021-45105Apache Software Foundation · CVSS 5.9 · 100% likely

   Apache

2. SQUID-2024:1 Denial of Service in HTTP Chunked DecodingCVE-2024-25111squid-cache · CVSS 8.6 · 65% likely

   Squid-Cache

3. SQUID-2023:10 Denial of Service in HTTP Request parsingCVE-2023-50269squid-cache · CVSS 8.6 · 58% likely

   Squid-Cache

4. Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service a…CVE-2021-4269736% likely
5. The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply nested arrays, whic…CVE-2007-128519% likely
6. Constructed ASN.1 types with a recursive definition could exceed the stackCVE-2018-0739OpenSSL · 19% likely

   OpenSSL

7. encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.CVE-2022-2467510.0% likely
8. curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.CVE-2020-8285https://github.com/curl/curl · CVSS 7.5 · 9.8% likely
9. A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misconfigured domain, because QName minimiza…CVE-2023-22617CVSS 7.5 · 7.5% likely
10. The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite rec…CVE-2016-3627CVSS 7.5 · 7.0% likely
11. An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and…CVE-2017-16419Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and ea… · 6.8% likely
12. In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+'…CVE-2018-207965.8% likely
13. In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail me…CVE-2020-121005.3% likely
14. jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows remote attackers to cause a denial of service (excessive recu…CVE-2018-57595.1% likely
15. In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).CVE-2020-122434.7% likely
16. In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar…CVE-2019-132884.6% likely
17. The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote att…CVE-2017-58394.5% likely
18. url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a…CVE-2020-252194.4% likely
19. MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support…CVE-2020-28196CVSS 7.5 · 4.2% likely
20. It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found in libxml2, making it vulnerable to a D…CVE-2016-9597Red Hat · 4.0% likely

    Red Hat

21. The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion.CVE-2018-16452CVSS 7.5 · 4.0% likely
22. The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited recursion.CVE-2018-16300CVSS 7.5 · 4.0% likely
23. Uncontrolled Recursion in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture fileCVE-2021-39929Wireshark Foundation · CVSS 7.5 · 3.8% likely

    Wireshark Foundation

24. In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and co…CVE-2019-122953.8% likely
25. Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP…CVE-2019-139553.8% likely
26. net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Tran…CVE-2021-315253.7% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.