目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-674 未经控制的递归 类漏洞列表 224

CWE-674 未经控制的递归 类弱点 224 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-674 属于资源管理不当类漏洞，指程序未对递归深度进行有效限制，导致内存或栈空间被过度消耗。攻击者通常通过构造深层嵌套的输入或恶意请求，触发无限或过深的递归调用，从而耗尽系统资源，引发拒绝服务攻击。开发者应在代码中设置明确的递归终止条件或最大深度阈值，并引入迭代逻辑替代深层递归，以确保资源使用的可控性。

MITRE CWE 官方描述
CWE：CWE-674 Uncontrolled Recursion（失控递归） 英文：产品未对发生的递归量进行适当控制，导致消耗过多资源，例如已分配的内存（allocated memory）或程序栈（program stack）。
常见影响 (2)
AvailabilityDoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
Resources including CPU, memory, and stack memory could be rapidly consumed or exhausted, eventually leading to an exit or crash.
ConfidentialityRead Application Data
In some cases, an application's interpreter might kill a process or thread that appears to be consuming too much resources, such as with PHP's memory_limit setting. When the interpreter kills the process/thread, it might report an error containing detailed information such as the application's insta…
缓解措施 (2)
ImplementationEnsure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
Effectiveness: Moderate
ImplementationIncrease the stack size.
Effectiveness: Limited
代码示例 (1)
In this example a mistake exists in the code where the exit condition contained in flg is never called. This results in the function calling itself over and over again until the stack is exhausted.
void do_something_recursive (int flg) { ... // Do some real work here, but the value of flg is unmodified if (flg) { do_something_recursive (flg); }    // flg is never modified so it is always TRUE - this call will continue until the stack explodes } int flag = 1; // Set to TRUE do_something_recursive (flag);
Bad · C
void do_something_recursive (int flg) { ... // Do some real work here // Modify value of flg on done condition if (flg) { do_something_recursive (flg); }    // returns when flg changes to 0 } int flag = 1; // Set to TRUE do_something_recursive (flag);
Good · C
CVE ID标题CVSS风险等级Published
CVE-2021-28210 SUSE ovmf 安全漏洞 — EDK II 7.1 -2021-06-11
CVE-2021-3530 GNU Binutils 安全漏洞 — binutils 7.5 -2021-06-02
CVE-2021-30471 Sourceforge PoDoFo 安全漏洞 — podofo 6.5 -2021-05-26
CVE-2021-30470 Sourceforge PoDoFo 安全漏洞 — podofo 5.5 -2021-05-26
CVE-2021-27432 Siemens SIMATIC OPC UA 安全漏洞 — OPC Foundation OPC UA .NET Standard and OPC UA .NET Legacy 7.5 -2021-05-20
CVE-2021-29615 Google TensorFlow 安全漏洞 — tensorflow 2.5 Low2021-05-14
CVE-2021-21359 TYPO3 安全漏洞 — TYPO3.CMS 5.9 Medium2021-03-23
CVE-2020-1898 Facebook HHVM 安全漏洞 — HHVM 7.5 -2021-03-11
CVE-2020-8285 HAXX libcurl 安全漏洞 — https://github.com/curl/curl 7.5 -2020-12-14
CVE-2020-10704 Samba 资源管理错误漏洞 — samba 7.5 High2020-05-06
CVE-2019-0001 Juniper MX Series Junos OS 资源管理错误漏洞 — Junos OS 7.5 -2019-01-15
CVE-2016-9597 Libxml2 缓冲区错误漏洞 — libxml2 7.5 -2018-07-30
CVE-2017-7515 Poppler pdfunite 安全漏洞 — poppler 5.5 -2017-06-06
CVE-2017-0886 Nextcloud Server 安全漏洞 — Nextcloud Server 6.5 -2017-04-05

CWE-674（未经控制的递归） 是常见的弱点类别，本平台收录该类弱点关联的 224 条 CVE 漏洞。