CWE-674: Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Consequences

• Availability: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
• Confidentiality: Read Application Data

How to prevent it

• Implementation: Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
• Implementation: Increase the stack size.

Recent advisories

• GHSA-hqq3-7jhf-c5jx — Forge: Denial of service in TLS record processing via call stack exhaustion
• GHSA-wwpr-jff3-395c — Crass: A large number of adjacent CSS comments can trigger a SystemStackError
• GHSA-6jxj-px6v-747w — Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
• GHSA-vvm8-gf78-28g4 — Go JOSE: Panics in JSON parsing
• EEF-CVE-2026-65628 — Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types
• GHSA-c9rx-x947-fp3h — ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
• GHSA-6wmf-3r64-vcwv — Crass : Large numeric exponents cause CPU and memory denial of service
• GHSA-p4wg-p73j-c528 — Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
• GHSA-2v3c-qxhr-7vpv — Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
• GHSA-mc4q-93x5-f6hj — Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability
• GHSA-qhr7-859c-m2p7 — brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
• GHSA-6j4f-fj2g-mc7p — brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
• GHSA-8wjv-2p76-3863 — PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
• GHSA-8vvx-rff5-p5rq — Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
• GHSA-xxc3-xpmc-vmvr — Vikunja: Unbounded nested task-filter recursion permits API process termination

All advisories for CWE-674