CWE-674 (未经控制的递归) — Vulnerability Class 147

CWE-674 represents a resource management weakness where software fails to properly limit recursive function calls, leading to excessive consumption of system resources like memory or the program stack. This flaw is typically exploited by attackers who craft specific inputs that trigger deep or infinite recursion, causing the application to crash or become unresponsive. Such exploitation results in a denial-of-service condition, effectively disrupting service availability for legitimate users without requiring authentication or complex privilege escalation. To mitigate this risk, developers must implement robust safeguards, such as setting explicit maximum recursion depth limits or converting recursive algorithms into iterative ones using explicit data structures. Additionally, rigorous code reviews and static analysis tools can help identify potential infinite loops, ensuring that all recursive paths have clear termination conditions and adequate resource controls.