CWE-674: Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
287 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-33498 — Parse Server: Query condition depth bypass via pre-validation transform pipeline
- CVE-2026-32944 — Parse Server crash via deeply nested query condition operators
- CVE-2025-66031 — node-forge ASN.1 Unbounded Recursion
- CVE-2025-54858 — BIG-IP Advanced WAF and ASM vulnerability
- CVE-2025-5302 — Denial of Service (DOS) in JSONReader in run-llama/llama_index
- CVE-2024-4340 — Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
- CVE-2025-9624 — OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS
- CVE-2026-33508 — Parse Server: LiveQuery subscription query depth bypass
- CVE-2025-4565 — Unbounded recursion in Python Protobuf
- CVE-2026-72686 — Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-72679 — Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-72647 — Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-72638 — Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-72636 — Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service
- CVE-2026-63144 — Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-56148 — Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2025-10728 — Uncontrolled recursion in Qt SVG module
- CVE-2025-1492 — Uncontrolled Recursion in Wireshark
- CVE-2024-0210 — Uncontrolled Recursion in Wireshark
- CVE-2025-57809 — XGrammar affected by Denial of Service by infinite recursion grammars
Recently published
- CVE-2026-22591 — Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS)
- CVE-2026-19201 — Denial of Service via Unbounded Recursion in go-attestation Windows SIPA Parser
- CVE-2026-73321 — XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser
- CVE-2026-11573 — QDomDocument::toByteArray() crashes when parsing svg file
- CVE-2026-17440 — IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
- CVE-2026-77465 — toml-node: Uncontrolled Recursion
- CVE-2026-84851 — Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6
- CVE-2026-14255 — IFC File Parsing Uncontrolled Recursion in Certain Autodesk Products
- CVE-2026-84175 — In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs
- CVE-2026-81928 — Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record
- CVE-2026-82797 — Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. This i
- CVE-2026-82604 — BareBones BBEdit Java Language recursion
- CVE-2026-78228 — Unbounded handle_error recursion enables denial of service in AshOban triggers
- CVE-2026-75758 — Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir
- CVE-2026-73209 — An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its
- CVE-2026-81724 — NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion
- CVE-2026-55588 — ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
- CVE-2026-16781 — SVG File Parsing Stack Exhaustion Vulnerability in Autodesk 3ds Max
- CVE-2026-76098 — Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
- CVE-2026-9769 — justhtml before 1.10.0 Denial of Service via deeply nested HTML
More specific weaknesses
- CWE-776 — XML Entity Expansion