Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

CVEs (462)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-13123 1Foxitsoftware 1Foxit Reader Jun 17, 2026 Sep 30, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Foxit Reader 9.6.0.25114 and earlier has two unique RecursiveCall bugs involving 3 functions exhausting available stack memory because of Uncontrolled Recursion in the V8 JavaScript engine (issue 1 of 2).
CVE-2019-11779 5Canonical DebianEclipse+2 more 6Backports Sle Debian LinuxFedora+3 more Jun 17, 2026 Sep 19, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then...Show more In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.Show less
CVE-2019-16163 4Canonical DebianFedoraproject+1 more 4Debian Linux FedoraOniguruma+1 more Jun 17, 2026 Sep 9, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.
CVE-2019-16088 1Glyphandcog 1Xpdfreader Jun 17, 2026 Sep 6, 2019 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 Xpdf 3.04 has a SIGSEGV in XRef::fetch in XRef.cc after many recursive calls to Catalog::countPageTree in Catalog.cc.
CVE-2019-15542 1Ammonia Project 1Ammonia Jun 17, 2026 Aug 26, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.
CVE-2018-20994 1Trust Dns Proto Project 1Trust Dns Proto Nov 21, 2024 Aug 26, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled.
CVE-2018-20993 1Yaml Rust Project 1Yaml Rust Nov 21, 2024 Aug 26, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization.
CVE-2019-15144 5Canonical DebianDjvulibre Project+2 more 5Debian Linux DjvulibreFedora+2 more Jun 17, 2026 Aug 18, 2019 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 In DjVuLibre 3.5.27, the sorting functionality (aka GArrayTemplate<TYPE>::sort) allows attackers to cause a denial-of-service (application crash due to an Uncontrolled Recursion) by crafting a PBM image file that is mish...Show more In DjVuLibre 3.5.27, the sorting functionality (aka GArrayTemplate<TYPE>::sort) allows attackers to cause a denial-of-service (application crash due to an Uncontrolled Recursion) by crafting a PBM image file that is mishandled in libdjvu/GContainer.h.Show less
CVE-2019-15118 5Canonical DebianLinux+2 more 10Active Iq Unified Manager Data Availability ServicesDebian Linux+7 more Jun 17, 2026 Aug 16, 2019 N/A· v4 5.5 MEDIUM· v3 4.9 MEDIUM· v2 check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion.
CVE-2019-14235 2Djangoproject Opensuse 2Django Leap Jun 17, 2026 Aug 2, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion w...Show more An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.Show less
CVE-2019-13103 1Denx 1U Boot Jun 17, 2026 Jul 29, 2019 N/A· v4 7.1 HIGH· v3 3.6 LOW· v2 A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data.
CVE-2019-13955 1Mikrotik 1Routeros Jun 17, 2026 Jul 26, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server via recursive parsing of JSON. Mal...Show more Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server via recursive parsing of JSON. Malicious code cannot be injected.Show less
CVE-2019-1010182 1Yaml Rust Project 1Yaml Rust Jun 17, 2026 Jul 25, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 yaml-rust 0.4.0 and earlier is affected by: Uncontrolled Recursion. The impact is: Denial of service by impossible to catch abort. The component is: YamlLoader::load_from_str function. The attack vector is: Parsing of a...Show more yaml-rust 0.4.0 and earlier is affected by: Uncontrolled Recursion. The impact is: Denial of service by impossible to catch abort. The component is: YamlLoader::load_from_str function. The attack vector is: Parsing of a malicious YAML document. The fixed version is: 0.4.1 and later.Show less
CVE-2019-1010183 1Serde Yaml Project 1Serde Yaml Jun 17, 2026 Jul 25, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 serde serde_yaml 0.6.0 to 0.8.3 is affected by: Uncontrolled Recursion. The impact is: Denial of service by aborting. The component is: from_* functions (all deserialization functions). The attack vector is: Parsing a ma...Show more serde serde_yaml 0.6.0 to 0.8.3 is affected by: Uncontrolled Recursion. The impact is: Denial of service by aborting. The component is: from_* functions (all deserialization functions). The attack vector is: Parsing a malicious YAML file. The fixed version is: 0.8.4 and later.Show less
CVE-2019-13288 1Glyphandcog 1Xpdfreader Jun 17, 2026 Jul 4, 2019 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar to CVE-2018-16646.
CVE-2019-13129 1Motorola 1Cx2l Mwr04l Firmware Jun 17, 2026 Jul 1, 2019 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 On the Motorola router CX2L MWR04L 1.01, there is a stack consumption (infinite recursion) issue in scopd via TCP port 8010 and UDP port 8080. It is caused by snprintf and inappropriate length handling.
CVE-2019-12295 4Canonical DebianF5+1 more 16Big Ip Access Policy Manager Big Ip Advanced Firewall ManagerBig Ip Analytics+13 more Jun 17, 2026 May 23, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion.
CVE-2019-12213 4Canonical DebianFedoraproject+1 more 4Debian Linux FedoraFreeimage+1 more Jun 17, 2026 May 20, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 When FreeImage 3.18.0 reads a special TIFF file, the TIFFReadDirectory function in PluginTIFF.cpp always returns 1, leading to stack exhaustion.
CVE-2019-12212 1Freeimage Project 1Freeimage Jun 17, 2026 May 20, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 When FreeImage 3.18.0 reads a special JXR file, the StreamCalcIFDSize function of JXRMeta.c repeatedly calls itself due to improper processing of the file, eventually causing stack exhaustion. An attacker can achieve a r...Show more When FreeImage 3.18.0 reads a special JXR file, the StreamCalcIFDSize function of JXRMeta.c repeatedly calls itself due to improper processing of the file, eventually causing stack exhaustion. An attacker can achieve a remote denial of service attack by sending a specially constructed file.Show less
CVE-2019-11413 1Artifex 1Mujs Jun 17, 2026 Apr 22, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Artifex MuJS 1.0.5. It has unlimited recursion because the match function in regexp.c lacks a depth check.

Previous 1...192021...24 Next