Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

CVEs (629)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-5591 1Xack 1Xack Dns Jun 17, 2026 Jun 5, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 XACK DNS 1.11.0 to 1.11.4, 1.10.0 to 1.10.8, 1.8.0 to 1.8.23, 1.7.0 to 1.7.18, and versions before 1.7.0 allow remote attackers to cause a denial of service condition resulting in degradation of the recursive resolver's...Show more XACK DNS 1.11.0 to 1.11.4, 1.10.0 to 1.10.8, 1.8.0 to 1.8.23, 1.7.0 to 1.7.18, and versions before 1.7.0 allow remote attackers to cause a denial of service condition resulting in degradation of the recursive resolver's performance or compromising the recursive resolver as a reflector in a reflection attack.Show less
CVE-2020-13800 3Canonical OpensuseQemu 3Leap QemuUbuntu Linux Jun 17, 2026 Jun 4, 2020 N/A· v4 6.0 MEDIUM· v3 4.9 MEDIUM· v2 ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call.
CVE-2019-20819 1Foxitsoftware 2Phantompdf Reader Jun 17, 2026 Jun 4, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It allows stack consumption via nested function calls for XML parsing.
CVE-2019-20815 1Foxitsoftware 1Phantompdf Jun 17, 2026 Jun 4, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Foxit PhantomPDF before 8.3.12. It allows stack consumption via nested function calls for XML parsing.
CVE-2020-13164 4Debian FedoraprojectOpensuse+1 more 4Debian Linux FedoraLeap+1 more Jun 17, 2026 May 19, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Wireshark 3.2.0 to 3.2.3, 3.0.0 to 3.0.10, and 2.6.0 to 2.6.16, the NFS dissector could crash. This was addressed in epan/dissectors/packet-nfs.c by preventing excessive recursion, such as for a cycle in the directory...Show more In Wireshark 3.2.0 to 3.2.3, 3.0.0 to 3.0.10, and 2.6.0 to 2.6.16, the NFS dissector could crash. This was addressed in epan/dissectors/packet-nfs.c by preventing excessive recursion, such as for a cycle in the directory graph on a filesystem.Show less
CVE-2020-12825 1Gnome 1Libcroco Jun 17, 2026 May 12, 2020 N/A· v4 7.1 HIGH· v3 5.8 MEDIUM· v2 libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption.
CVE-2020-10704 4Debian FedoraprojectOpensuse+1 more 4Debian Linux FedoraLeap+1 more Jun 17, 2026 May 6, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overf...Show more A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overflow leading to a denial of service. The highest threat from this vulnerability is to system availability. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2.Show less
CVE-2018-21232 1Re2c 1Re2c Nov 21, 2024 Apr 29, 2020 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.
CVE-2020-12243 8Apple BroadcomCanonical+5 more 18Brocade Fabric Operating System Cloud BackupDebian Linux+15 more Oct 14, 2026 Apr 28, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).
CVE-2019-8961 1Flexera 1Flexnet Publisher Jun 17, 2026 Apr 21, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Denial of Service vulnerability related to stack exhaustion has been identified in FlexNet Publisher lmadmin.exe 11.16.2. Because the message reading function calls itself recursively given a certain condition in the r...Show more A Denial of Service vulnerability related to stack exhaustion has been identified in FlexNet Publisher lmadmin.exe 11.16.2. Because the message reading function calls itself recursively given a certain condition in the received message, an unauthenticated remote attacker can repeatedly send messages of that type to cause a stack exhaustion condition.Show less
CVE-2020-11647 3Debian OpensuseWireshark 3Debian Linux LeapWireshark Jun 17, 2026 Apr 10, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Wireshark 3.2.0 to 3.2.2, 3.0.0 to 3.0.9, and 2.6.0 to 2.6.15, the BACapp dissector could crash. This was addressed in epan/dissectors/packet-bacapp.c by limiting the amount of recursion.
CVE-2020-6071 2Debian Videolabs 2Debian Linux Libmicrodns Oct 8, 2026 Mar 24, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the compression pointer is followed with...Show more An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the compression pointer is followed without checking for recursion, leading to a denial of service. An attacker can send an mDNS message to trigger this vulnerability.Show less
CVE-2019-18936 1Bloq 1Univalue Jun 17, 2026 Mar 21, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 UniValue::read() in UniValue before 1.0.5 allow attackers to cause a denial of service (the class internal data reaches an inconsistent state) via input data that triggers an error.
CVE-2020-10089 1Gitlab 1Gitlab Jun 17, 2026 Mar 13, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother,
CVE-2019-20395 1Cesnet 1Libyang Jun 17, 2026 Jan 22, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.
CVE-2019-20334 1Nasm 1Netwide Assembler Jun 17, 2026 Jan 4, 2020 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 In Netwide Assembler (NASM) 2.14.02, stack consumption occurs in expr# functions in asm/eval.c. This potentially affects the relationships among expr0, expr1, expr2, expr3, expr4, expr5, and expr6 (and stdscan in asm/std...Show more In Netwide Assembler (NASM) 2.14.02, stack consumption occurs in expr# functions in asm/eval.c. This potentially affects the relationships among expr0, expr1, expr2, expr3, expr4, expr5, and expr6 (and stdscan in asm/stdscan.c). This is similar to CVE-2019-6290 and CVE-2019-6291.Show less
CVE-2019-20198 1Ezxml Project 1Ezxml Jun 17, 2026 Dec 31, 2019 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_ent_ok() mishandles recursion, leading to stack consumption for a crafted XML file.
CVE-2019-19645 5Netapp OracleSiemens+2 more 6Cloud Backup Mysql WorkbenchOntap Select Deploy Administration Utility+3 more Oct 14, 2026 Dec 9, 2019 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.
CVE-2019-11937 1Facebook 1Mcrouter Jun 17, 2026 Dec 4, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Mcrouter prior to v0.41.0, a large struct input provided to the Carbon protocol reader could result in stack exhaustion and denial of service.
CVE-2019-18854 110up 1Safe Svg Jun 17, 2026 Nov 11, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ... xlink:href="#identifier">' substring.

Previous 1...262728...32 Next