- What is CWE-674?
- The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
- What CVEs are caused by CWE-674?
- 228 recorded CVEs are attributed to CWE-674, including CVE-2026-25971, CVE-2023-51803, CVE-2025-10728.
- Is CWE-674 part of the OWASP Top 10?
- CWE-674 maps to OWASP Top Ten 2004: Denial of Service (A9) in the OWASP security taxonomy.
- How do you prevent CWE-674?
- Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
- How is CWE-674 detected?
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
- What are the consequences of CWE-674?
- Exploiting CWE-674 can lead to: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), Read Application Data.
- Is CWE-674 actively exploited?
- 228 recorded CVEs are caused by CWE-674; none are currently in CISA's KEV catalog of actively exploited flaws.
