CWE-674: Uncontrolled Recursion
Also known as: Stack Exhaustion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Last updated
Overview
CWE-674 (Uncontrolled Recursion) is a class-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.
Real-world CVEs
287 recorded CVEs are caused by CWE-674 (Uncontrolled Recursion). The highest-severity and most recent are shown first. 161 new CWE-674 CVEs have been recorded so far in 2026 (43 in 2025).
- CVE-2026-25971
ImageMagick's MSL: Stack overflow in ProcessMSLScript
Critical · CVSS 9.8 · EPSS 11th2026-02-24 - CVE-2023-51803Critical · CVSS 9.8 · EPSS 51th2024-03-31
- CVE-2025-10728
Uncontrolled recursion in Qt SVG module
Critical · CVSS 9.4 · EPSS 10th2025-10-03 - CVE-2026-32327
Apache Portable Runtime Utility: apr-util XML stack recursion crash
Critical · CVSS 9.1 · EPSS 38th2026-08-06 - CVE-2026-40324
Hot Chocolate's Utf8GraphQLParser has Stack Overflow via Deeply Nested GraphQL Documents
Critical · CVSS 9.1 · EPSS 57th2026-04-17 - CVE-2023-2663Critical · CVSS 9.1 · EPSS 40th2023-05-11
- CVE-2024-37973
Secure Boot Security Feature Bypass Vulnerability
High · CVSS 8.8 · EPSS 48th2024-07-09 - CVE-2026-9769
justhtml before 1.10.0 Denial of Service via deeply nested HTML
High · CVSS 8.7 · EPSS 20th2026-08-23 - CVE-2026-66393
NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder
High · CVSS 8.7 · EPSS 29th2026-08-22 - CVE-2026-69220
RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
High · CVSS 8.7 · EPSS 33th2026-08-18 - CVE-2026-74795
Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion
High · CVSS 8.7 · EPSS 24th2026-08-16 - CVE-2026-74794
Scriban before 6.6.0 Denial of Service via Infinite Recursion
High · CVSS 8.7 · EPSS 20th2026-08-16
Showing 12 of 287 recorded CWE-674 CVEs. Track new ones as they are published and get AI-written analysis and fixes.
Monitor CWE-674 vulnerabilitiesCommon consequences
What can happen when CWE-674 is exploited.
DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
Affects: Availability
Resources including CPU, memory, and stack memory could be rapidly consumed or exhausted, eventually leading to an exit or crash.
Read Application Data
Affects: Confidentiality
In some cases, an application's interpreter might kill a process or thread that appears to be consuming too much resources, such as with PHP's memory_limit setting. When the interpreter kills the process/thread, it might report an error containing detailed information such as the application's installation path.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
How to prevent it
Practical mitigations for CWE-674, grouped by where in the lifecycle they apply.
Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
Effectiveness: Moderate
Increase the stack size.
Effectiveness: Limited — Increasing the stack size might only be a temporary measure, since the stack typically is still not very large, and it might remain easy for attackers to cause an out-of-stack fault.
How to detect it
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
In this example a mistake exists in the code where the exit condition contained in flg is never called. This results in the function calling itself over and over again until the stack is exhausted.
Vulnerable example
... // Do some real work here, but the value of flg is unmodifiedSafe example
... // Do some real work hereNote that the only difference between the Good and Bad examples is that the recursion flag will change value and cause the recursive call to return.
Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2007-1285 — Deeply nested arrays trigger stack exhaustion.
- CVE-2007-3409 — Self-referencing pointers create infinite loop and resultant stack exhaustion.
- CVE-2016-10707 — Javascript application accidentally changes input in a way that prevents a recursive call from detecting an exit condition.
- CVE-2016-3627 — An attempt to recover a corrupted XML file infinite recursion protection counter was not always incremented missing the exit condition.
- CVE-2019-15118 — USB-audio driver's descriptor code parsing allows unlimited recursion leading to stack exhaustion.
Terminology & mappings
Alternate terms
- Stack Exhaustion
Mapped taxonomies
- OWASP Top Ten 2004: Denial of Service (A9) — CWE More Specific fit
- Software Fault Patterns: Unrestricted Consumption (SFP13)
- OMG ASCRM (ASCRM-CWE-674)
Attack patterns
CAPEC attack patterns that exploit this weakness.
Frequently asked questions
Common questions about CWE-674.
- What is CWE-674?
- The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
- What CVEs are caused by CWE-674?
- 287 recorded CVEs are attributed to CWE-674, including CVE-2026-25971, CVE-2023-51803, CVE-2025-10728.
- Is CWE-674 part of the OWASP Top 10?
- CWE-674 maps to OWASP Top Ten 2004: Denial of Service (A9) in the OWASP security taxonomy.
- How do you prevent CWE-674?
- Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
- How is CWE-674 detected?
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
- What are the consequences of CWE-674?
- Exploiting CWE-674 can lead to: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), Read Application Data.
- Is CWE-674 actively exploited?
- 287 recorded CVEs are caused by CWE-674; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-674) (opens in a new tab)
- CWE-674 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-674
Get alerted the moment a new CWE-674 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.