CWE-674 · Denial of Service
Uncontrolled Recursion
622CVEs
0exploited
0with a public check
6likely (EPSS 10%+)
SortMost likely exploited
622 CVEs with CWE-674 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2021-45105Apache Log4j2 does not always protect from infinite recursion in lookup evaluationApache Software Foundation · Apache Log4j2 · CVSS 5.9 · 2021-12-18 | 5.9 | 100% | 2021-12-18 |
| CVE-2024-25111SQUID-2024:1 Denial of Service in HTTP Chunked Decodingsquid-cache · squid · CVSS 8.6 · 2024-03-06 | 8.6 | 65% | 2024-03-06 |
| CVE-2023-50269SQUID-2023:10 Denial of Service in HTTP Request parsingsquid-cache · squid · CVSS 8.6 · 2023-12-14 | 8.6 | 58% | 2023-12-14 |
| CVE-2021-42697Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service a…Akka · Http Server · 2021-11-02 | – | 36% | 2021-11-02 |
| CVE-2007-1285The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply nested arrays, whic…Php · Php · 2007-03-06 | – | 19% | 2007-03-06 |
| CVE-2018-0739Constructed ASN.1 types with a recursive definition could exceed the stackOpenSSL · OpenSSL · 2018-03-27 | – | 19% | 2018-03-27 |
| CVE-2022-24675encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.Golang · Go · 2022-04-20 | – | 10.0% | 2022-04-20 |
| CVE-2020-8285curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.Haxx · https://github.com/curl/curl · CVSS 7.5 · 2020-12-14 | 7.5 | 9.8% | 2020-12-14 |
| CVE-2023-22617A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misconfigured domain, because QName minimiza…Powerdns · Recursor · CVSS 7.5 · 2023-01-21 | 7.5 | 7.5% | 2023-01-21 |
| CVE-2016-3627The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite rec…Xmlsoft · Libxml2 · CVSS 7.5 · 2016-05-17 | 7.5 | 7.0% | 2016-05-17 |
| CVE-2017-16419An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and…Adobe · Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and ea… · 2017-12-09 | – | 6.8% | 2017-12-09 |
| CVE-2018-20796In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+'…Gnu · Glibc · 2019-02-26 | – | 5.8% | 2019-02-26 |
| CVE-2020-12100In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail me…Dovecot · Dovecot · 2020-08-12 | – | 5.3% | 2020-08-12 |
| CVE-2018-5759jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows remote attackers to cause a denial of service (excessive recu…Artifex · Mujs · 2018-01-24 | – | 5.1% | 2018-01-24 |
| CVE-2020-12243In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).Openldap · Openldap · 2020-04-28 | – | 4.7% | 2020-04-28 |
| CVE-2019-13288In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar…Glyphandcog · Xpdfreader · 2019-07-04 | – | 4.6% | 2019-07-04 |
| CVE-2017-5839The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote att…Gstreamer · Gstreamer · 2017-02-09 | – | 4.5% | 2017-02-09 |
| CVE-2020-25219url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a…Libproxy Project · Libproxy · 2020-09-09 | – | 4.4% | 2020-09-09 |
| CVE-2020-28196MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support…Mit · Kerberos 5 · CVSS 7.5 · 2020-11-06 | 7.5 | 4.2% | 2020-11-06 |
| CVE-2016-9597It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found in libxml2, making it vulnerable to a D…Red Hat · libxml2 · 2018-07-30 | – | 4.0% | 2018-07-30 |
| CVE-2018-16452The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion.Tcpdump · Tcpdump · CVSS 7.5 · 2019-10-03 | 7.5 | 4.0% | 2019-10-03 |
| CVE-2018-16300The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited recursion.Tcpdump · Tcpdump · CVSS 7.5 · 2019-10-03 | 7.5 | 4.0% | 2019-10-03 |
| CVE-2021-39929Uncontrolled Recursion in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture fileWireshark Foundation · Wireshark · CVSS 7.5 · 2021-11-19 | 7.5 | 3.8% | 2021-11-19 |
| CVE-2019-12295In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and co…Wireshark · Wireshark · 2019-05-23 | – | 3.8% | 2019-05-23 |
| CVE-2019-13955Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP…Mikrotik · Routeros · 2019-07-26 | – | 3.8% | 2019-07-26 |
| CVE-2021-31525net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Tran…Golang · Go · 2021-05-27 | – | 3.7% | 2021-05-27 |
| CVE-2020-10704A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an…Red Hat · samba · CVSS 7.5 · 2020-05-06 | 7.5 | 3.5% | 2020-05-06 |
| CVE-2020-11647In Wireshark 3.2.0 to 3.2.2, 3.0.0 to 3.0.9, and 2.6.0 to 2.6.15, the BACapp dissector could crash. This was addressed in epan/dissectors/packet-bacapp.c by limiting the amount of…Wireshark · Wireshark · 2020-04-10 | – | 3.5% | 2020-04-10 |
| CVE-2007-3409Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers,…Net-Dns · Net::dns · CVSS 7.5 · 2007-06-26 | 7.5 | 3.5% | 2007-06-26 |
| CVE-2017-9766In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in the dissect_IODWriteReq function in plu…Wireshark · Wireshark · 2017-06-21 | – | 3.4% | 2017-06-21 |
| CVE-2019-9543An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file…Freedesktop · Poppler · 2019-03-01 | – | 3.3% | 2019-03-01 |
| CVE-2022-25313In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.Libexpat Project · Libexpat · CVSS 6.5 · 2022-02-18 | 6.5 | 3.3% | 2022-02-18 |
| CVE-2021-42717ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to s…Owasp · Modsecurity · 2021-12-07 | – | 3.2% | 2021-12-07 |
| CVE-2018-8015In Apache ORC 1.0.0 to 1.4.3 a malformed ORC file can trigger an endlessly recursive function call in the C++ or Java parser. The impact of this bug is most likely denial-of-servi…Apache Software Foundation · Apache ORC · 2018-05-18 | – | 3.2% | 2018-05-18 |
| CVE-2016-10707jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attri…Jquery · Jquery · 2018-01-18 | – | 3.2% | 2018-01-18 |
| CVE-2022-24921regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.Golang · Go · 2022-03-05 | – | 3.2% | 2022-03-05 |
| CVE-2024-4340Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.No vendor recorded · CVSS 7.5 · 2024-04-30 | 7.5 | 3.2% | 2024-04-30 |
| CVE-2017-11164In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.Pcre · Pcre · 2017-07-11 | – | 3.1% | 2017-07-11 |
| CVE-2019-14235An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to sign…Djangoproject · Django · 2019-08-02 | – | 3.1% | 2019-08-02 |
| CVE-2019-0001Junos OS: MX Series: uncontrolled recursion and crash in Broadband Edge subscriber management daemon (bbe-smgd).Juniper Networks · Junos OS · CVSS 7.5 · 2019-01-15 | 7.5 | 3.0% | 2019-01-15 |
| CVE-2020-13164In Wireshark 3.2.0 to 3.2.3, 3.0.0 to 3.0.10, and 2.6.0 to 2.6.16, the NFS dissector could crash. This was addressed in epan/dissectors/packet-nfs.c by preventing excessive recurs…Wireshark · Wireshark · 2020-05-19 | – | 3.0% | 2020-05-19 |
| CVE-2024-5971Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticketRedhat · undertow · CVSS 7.5 · 2024-07-08 | 7.5 | 2.9% | 2024-07-08 |
| CVE-2018-6003An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.Gnu · Libtasn1 · 2018-01-22 | – | 2.8% | 2018-01-22 |
| CVE-2019-9144An issue was discovered in Exiv2 0.27. There is infinite recursion at BigTiffImage::printIFD in the file bigtiffimage.cpp. This can be triggered by a crafted file. It allows an at…Exiv2 · Exiv2 · 2019-02-25 | – | 2.8% | 2019-02-25 |
| CVE-2019-9143An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file image.cpp. This can be triggered by a crafted file. It allows an…Exiv2 · Exiv2 · 2019-02-25 | – | 2.8% | 2019-02-25 |
| CVE-2019-17450find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of serv…Gnu · Binutils · 2019-10-10 | – | 2.8% | 2019-10-10 |
| CVE-2019-16163Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.Oniguruma Project · Oniguruma · 2019-09-09 | – | 2.8% | 2019-09-09 |
| CVE-2019-9904An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphviz 2.40.1. Stack consumption occurs because of recursive agclose calls in lib\cgraph\graph.c in libcgraph.a, relat…Graphviz · Graphviz · 2019-03-21 | – | 2.7% | 2019-03-21 |
| CVE-2025-48924Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputsApache Software Foundation · Apache Commons Lang · CVSS 5.3 · 2025-07-11 | 5.3 | 2.6% | 2025-07-11 |
| CVE-2019-18854A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ... xlink:href="#identifier"…10up · Safe Svg · 2019-11-11 | – | 2.6% | 2019-11-11 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.