Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Missing try/catch for RangeError during recursive Joi validation call. Maliciously crafted deeply nested schema references can cause stack overflow and crash the process, resulting in a Denial of Service.
A map lookup is used to resolve hierarchical node references, but there is no check for circular references. When parsing untrusted or malformed data, this can create cyclical structures that lead to infinite recursion and stack exhaustion during traversal. Implement a cycle detection mechanism (e.g., matching against a set of cyclic nodes) before resolving
The `$FUNC` method appears to parse or decode structures recursively without tracking the recursion depth. Although it passes unmodified state securely (e.g. typical cycle detection via a seen set), an attacker could provide a long chain of valid forward links that bypasses cycle checks but causes uncontrolled recursion, leading to a stack exhaustion Denial
Module dependencies are evaluated before registering the current module in the state tracking. This allows cyclic imports to trigger uncontrolled recursion (CWE-674), leading to stack exhaustion and Denial of Service. Ensure the module load state is updated to reflect that it is 'loading' before calling `process_dependencies`.
An unconditional 'continue' follows a specific exclusion condition. For loop control flows where the excluded value is intended to fall through and process subsequent configurations (such as SSR handler assignments), an unconditional continue mistakenly skips the rest of the loop block. Ensure the continue is guarded conditionally or correctly isolated.
Unbounded recursion detected in a generic merge or recursive function. This can lead to stack exhaustion (CWE-674) if processing attacker-controlled nested structures. Pass a depth/level parameter and abort if it exceeds a maximal threshold.
A block render generator function calls the template renderer without a re-entrancy (cycle-detection) guard. When the same block tag is nested inside itself via layout inheritance, the stored render closure is retrieved from the register and re-invoked indefinitely, exhausting heap memory and crashing the process (CWE-674, CVE-2026-41311). Before calling the
Recursive descent parser entry-point method in Utf8GraphQLParser is missing the IncreaseDepth() / DecreaseDepth() recursion-depth guard. An attacker can submit a GraphQL document with deeply nested selection sets, list values, object values, or list/non-null type references that exhausts the managed stack and raises a StackOverflowException, which is uncatch
Array.splice() is called inside a backward-decrement while loop but the enclosing block only returns conditionally (inside a nested if) after removal. When the condition is false the loop continues iterating over the now-shorter array with stale index bounds, causing state corruption that can crash the process or corrupt shared state under concurrent access
A function operating on an array checks its type and base case (length == 0), but fails to enforce a maximum length limit or recursion depth limit. If this function is recursive, processing a deeply nested or excessively long array originating from untrusted input could lead to unbounded recursion, causing a stack overflow (DoS).
This tree destruction function recursively frees nodes without maintaining a depth counter. Deeply nested data structures can cause stack exhaustion leading to Denial of Service.
The read value of CSR henvcfg is masked with the full MENVCFG_WMASK against menvcfg (e.g. `henvcfg_out &= menvcfg->val & MENVCFG_WMASK;`). Because MENVCFG_WMASK covers bits [7:4] (CBIE/CBCFE/CBZE) in addition to STCE/DTE/PBMTE, this overbroad mask incorrectly subordinates henvcfg's cache-block-management fields to menvcfg. Per the RISC-V H-extension specific
Uncontrolled mutual recursion (CWE-674) in standard parser combinators. The functions recursively call each other when parsing nested grammar elements without tracking recursion depth. An attacker can craft deeply nested inputs (such as repeating parenthesis) to exhaust the call stack, resulting in Denial of Service (DoS) via stack overflow.
RustCVE-2026-25727A new lookup node is created and processed without checking for CNAME loops, which could lead to unbounded recursion.
Dynamically dispatching recursive parsing operations using `methodcaller` can bypass recursion depth limits tracked in centralized parsing methods. This can lead to uncontrolled recursion (DoS). Ensure that nested structures are routed through methods that actively enforce recursion depth limits.
Uncontrolled recursion detected. The recursive function takes a depth parameter but does not validate it against a maximum threshold. A deeply nested structure could trigger stack exhaustion and lead to a Denial of Service (DoS).
A cycle detection mechanism was found that throws or returns upon detecting a duplicate, but lacks a corresponding limit on the collection's size. When this collection represents traversal depth or inclusion history, lacking a size bound can lead to Stack Exhaustion (CWE-674) or Uncontrolled Resource Consumption (CWE-400) via deeply nested structures. Enforc
Missing depth limit in recursive HTTP redirect handling. Recursively following HTTP redirects without maintaining and checking a recursion depth limit allows an attacker to cause an infinite redirect loop (DoS). Add a depth counter parameter and reject if it exceeds a maximum threshold.
A Windows reserved-device-name denylist enumerates the ASCII variants COM1..COM9 and LPT1..LPT9 but does not include the ISO-8859-1 superscript variants COM¹, COM², COM³, LPT¹, LPT², LPT³ (U+00B9 / U+00B2 / U+00B3). Windows resolves these Unicode names to the same physical COM/LPT devices, and `to_uppercase()` / ASCII case folding does not normalize superscr
A function accepting an array by reference recursively calls itself using a by-value copy of an element from a `foreach` loop. Modifications made by the recursive call overwrite the local copy rather than the original array, meaning sanitizations and validations are bypassed for nested items. To fix this, pass the explicit array index reference (e.g., `$ARR[
A recursive parser instantiation drops the parent parser state. By using `new $CLASS(...)` inside its own class methods instead of using an internal subparser method, the new parser starts with reset resource limits (like depth counters or macro expansion limits). This can allow attackers to bypass Denial of Service (DoS) protections like recursion depth or
App allows self signed or invalid SSL certificates. App is vulnerable to MITM attacks. If the app does not verify the authenticity of the server's SSL certificate, an attacker could impersonate the server and intercept sensitive data transmitted between the app and the server. To fix these security issues, you should ensure proper SSL certificate validation
The `usleep` function has been deprecated, use `nanosleep` or `setitimer` instead. For more information please see: https://linux.die.net/man/3/setitimer
The ulimit function is obsolete and no longer recommended. Use `getrlimit(2)`, `setrlimit`, or `sysconf` instead. For more information please see: https://linux.die.net/man/3/setrlimit
