Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This vulnerability is very similar, but not identical, to the one described in CVE-2021-21359. This issue is patched in versions 9.5.38 ELTS, 10.4.33, 11.5.20 or 12.1.1.

CVE-2022-23500 is a medium-severity vulnerability affecting TYPO3, an open-source PHP-based web content management system widely used for building and managing websites. The vulnerability arises from uncontrolled recursion in the error handling mechanism of TYPO3 versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1. Specifically, when a user requests an invalid or non-existent resource via HTTP, TYPO3 triggers its page error handler. This handler attempts to retrieve content to display as an error message from another page. However, if this referenced page is also invalid or leads back to the error handler, the application enters a recursive loop, repeatedly calling itself. This uncontrolled recursion can amplify the initial request's impact, potentially exhausting server resources such as CPU and memory, leading to denial of service (DoS) conditions by exceeding web server limits. The vulnerability is related to CWE-674 (Uncontrolled Recursion), indicating a failure to properly limit recursive calls in the application logic. Although similar to CVE-2021-21359, this issue is distinct in its specific recursion trigger and affected TYPO3 versions. No known exploits have been reported in the wild, and patches have been released in the specified TYPO3 versions to address this issue. The vulnerability does not require authentication or user interaction beyond sending crafted HTTP requests to invalid resources, making it relatively easy to trigger if the system is exposed to untrusted users or the internet.

Detailed information about CVE-2022-23500: CWE-674: Uncontrolled Recursion in TYPO3 typo3 affecting TYPO3 typo3. Get real-time updates, technical details, and m

CVE-2022-23500: CWE-674: Uncontrolled Recursion in TYPO3 typo3 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-23500: CWE-674: Uncontrolled Recursion in TYPO3 typo3

Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder.

CVE-2022-41881 is a vulnerability in the Netty project, an event-driven asynchronous network application framework widely used for building high-performance network servers and clients. The vulnerability, classified under CWE-674 (Uncontrolled Recursion), affects Netty versions prior to 4.1.86.Final. Specifically, the issue arises when Netty parses a malformed or specially crafted message, which triggers an infinite recursion in the message decoding logic. This uncontrolled recursion leads to a StackOverflowError, causing the affected application to crash or become unresponsive. The root cause is a lack of proper input validation or recursion control in the message parsing code, which fails to handle malformed inputs gracefully. The vulnerability does not require authentication or user interaction to be exploited, as it can be triggered by sending a crafted network message to a vulnerable Netty-based service. There is no known workaround other than upgrading to version 4.1.86.Final or later, where the issue has been patched. Alternatively, a custom HaProxyMessageDecoder can be implemented to mitigate the risk. No known exploits have been reported in the wild, but the vulnerability poses a risk of denial-of-service (DoS) attacks by crashing network services that rely on vulnerable Netty versions.

Detailed information about CVE-2022-41881: CWE-674: Uncontrolled Recursion in netty netty affecting netty netty. Get real-time updates, technical details, and m

CVE-2022-41881: CWE-674: Uncontrolled Recursion in netty netty - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-41881: CWE-674: Uncontrolled Recursion in netty netty

rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately. This is a security concern for you, if your service parses untrusted rulex expressions (expressions provided by an untrusted user), and your service becomes unavailable when the process running rulex aborts due to a stack overflow. The crash is fixed in version **0.4.3**. Affected users are advised to update to this version. There are no known workarounds for this issue.

CVE-2022-31099 is a vulnerability in the rulex-rs project, specifically affecting the rulex regular expression language parser prior to version 0.4.3. Rulex is designed as a portable regular expression language, and this vulnerability arises from uncontrolled recursion during the parsing of rulex expressions. When an attacker supplies a rulex expression with several hundred levels of nested constructs, the parser's recursion depth can exceed the stack limits, leading to a stack overflow. This overflow causes the process running the rulex parser to abort immediately, resulting in a Denial of Service (DoS) condition. The vulnerability is categorized under CWE-674 (Uncontrolled Recursion), indicating that the parser does not adequately limit or control recursion depth when processing untrusted input. The issue is critical for any service or application that parses rulex expressions provided by untrusted users, as it can be exploited to crash the service, making it unavailable. The vulnerability was fixed in version 0.4.3 of rulex, and no known workarounds exist. There are no reports of active exploitation in the wild. The vulnerability requires no authentication or user interaction beyond supplying the crafted expression, making it relatively easy to exploit if the affected parser is exposed to untrusted input. The scope is limited to software components using the vulnerable versions of rulex for parsing expressions.

Detailed information about CVE-2022-31099: CWE-674: Uncontrolled Recursion in rulex-rs rulex affecting rulex-rs rulex. Get real-time updates, technical details,

CVE-2022-31099: CWE-674: Uncontrolled Recursion in rulex-rs rulex - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-31099: CWE-674: Uncontrolled Recursion in rulex-rs rulex

Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is sometimes recoverable and leads to an error for the request causing the problem, but in other cases the Synapse process may crash altogether. It is possible to exploit this maliciously, either by malicious users on the homeserver, or by remote users sending URLs that a local user's client may automatically request a URL preview for. Remote users are not able to exploit this directly, because the URL preview endpoint is authenticated. Deployments with `url_preview_enabled: false` set in configuration are not affected. Deployments with `url_preview_enabled: true` set in configuration **are** affected. Deployments with no configuration value set for `url_preview_enabled` are not affected, because the default is `false`. Administrators of homeservers with URL previews enabled are advised to upgrade to v1.61.1 or higher. Users unable to upgrade should set `url_preview_enabled` to false.

CVE-2022-31052 is a medium-severity vulnerability affecting the Matrix Synapse server, an open-source home server implementation for the Matrix chat network. The issue arises from uncontrolled recursion in the URL preview feature of Synapse versions prior to 1.61.1. Specifically, when URL previews are enabled (via the configuration setting `url_preview_enabled: true`), certain web pages can trigger unbounded recursive calls during the preview generation process. This recursion can exhaust the available stack space of the Synapse process, leading to either an error for the specific request or, in more severe cases, a complete crash of the Synapse server process. The vulnerability is exploitable by malicious users authenticated on the homeserver or by remote users who send URLs that a local user's client automatically requests a preview for. However, remote exploitation is limited because the URL preview endpoint requires authentication, preventing unauthenticated remote attackers from directly triggering the vulnerability. Deployments with the URL preview feature disabled (`url_preview_enabled: false`) or those using the default configuration (which disables URL previews) are not affected. The recommended remediation is to upgrade Synapse to version 1.61.1 or later, where the recursion issue has been addressed. For administrators unable to upgrade promptly, disabling URL previews is advised to mitigate the risk. No known exploits have been reported in the wild, but the vulnerability presents a risk of denial-of-service through server crashes or degraded service availability.

Detailed information about CVE-2022-31052: CWE-674: Uncontrolled Recursion in matrix-org synapse affecting matrix-org synapse. Get real-time updates, technical 

CVE-2022-31052: CWE-674: Uncontrolled Recursion in matrix-org synapse - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-31052: CWE-674: Uncontrolled Recursion in matrix-org synapse

Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.

CVE-2022-23606 is a medium-severity vulnerability affecting Envoy, an open-source edge and service proxy widely used in cloud-native application architectures. The vulnerability arises from uncontrolled recursion in the process of disconnecting idle connections when a cluster is deleted via the Cluster Discovery Service (CDS). Specifically, when a cluster is removed, Envoy attempts to disconnect all idle connections associated with that cluster's endpoints. Due to a recursive call in the disconnection logic, if the cluster has a large number of idle connections, the recursion depth can grow excessively, leading to stack exhaustion. This results in abnormal process termination or a crash of the Envoy proxy. The affected versions include Envoy releases from 1.20.0 up to but not including 1.20.2, and from 1.21.0 up to but not including 1.21.1. The vulnerability is categorized under CWE-674 (Uncontrolled Recursion), which indicates a failure to properly limit recursion depth, causing resource exhaustion. No known exploits have been reported in the wild, but the impact is a denial of service (DoS) condition due to process crash. Users are advised to upgrade to patched versions beyond 1.20.2 or 1.21.1 to mitigate this issue. Since Envoy is often deployed as a critical component in service meshes, API gateways, and edge proxies, this vulnerability can disrupt service availability if exploited or triggered unintentionally during cluster management operations.

Detailed information about CVE-2022-23606: CWE-674: Uncontrolled Recursion in envoyproxy envoy affecting envoyproxy envoy. Get real-time updates, technical deta

Title	Severity	Type	Source	Date

Threats Tagged 'cwe-674-uncontrolled-recursion'

Filter Threats

Threats Tagged 'cwe-674-uncontrolled-recursion'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility