CWE-674 Uncontrolled Recursion

kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability

Django GeoDjango vulnerable to denial of service through deeply nested geometry collections

Vikunja: Unbounded nested task-filter recursion permits API process termination

Duplicate Advisory: Vikunja: Unbounded nested task-filter recursion permits API process termination

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

msgpack5: Many buffered values can exhaust the streaming decoder stack

msgpack5: Deeply nested input can exhaust the decoder stack

Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow

yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

braces vulnerable to stack-exhaustion denial of service through deeply nested patterns

Nest: Remote process termination via a deeply nested microservice message pattern

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard

Denial of Service in pyasn1 via Unbounded Recursion

Axios form serializer maxDepth bypass via {} metatoken

Duplicate Advisory: Axios form serializer maxDepth bypass via {} metatoken

SurrealDB has Denial of Service in JSON parser due to nested objects