Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Missing try/catch for RangeError during recursive Joi validation call. Maliciously crafted deeply nested schema references can cause stack overflow and crash the process, resulting in a Denial of Service.
A map lookup is used to resolve hierarchical node references, but there is no check for circular references. When parsing untrusted or malformed data, this can create cyclical structures that lead to infinite recursion and stack exhaustion during traversal. Implement a cycle detection mechanism (e.g., matching against a set of cyclic nodes) before resolving
The `$FUNC` method appears to parse or decode structures recursively without tracking the recursion depth. Although it passes unmodified state securely (e.g. typical cycle detection via a seen set), an attacker could provide a long chain of valid forward links that bypasses cycle checks but causes uncontrolled recursion, leading to a stack exhaustion Denial
Module dependencies are evaluated before registering the current module in the state tracking. This allows cyclic imports to trigger uncontrolled recursion (CWE-674), leading to stack exhaustion and Denial of Service. Ensure the module load state is updated to reflect that it is 'loading' before calling `process_dependencies`.
Unbounded recursion detected in a generic merge or recursive function. This can lead to stack exhaustion (CWE-674) if processing attacker-controlled nested structures. Pass a depth/level parameter and abort if it exceeds a maximal threshold.
A block render generator function calls the template renderer without a re-entrancy (cycle-detection) guard. When the same block tag is nested inside itself via layout inheritance, the stored render closure is retrieved from the register and re-invoked indefinitely, exhausting heap memory and crashing the process (CWE-674, CVE-2026-41311). Before calling the
Recursive descent parser entry-point method in Utf8GraphQLParser is missing the IncreaseDepth() / DecreaseDepth() recursion-depth guard. An attacker can submit a GraphQL document with deeply nested selection sets, list values, object values, or list/non-null type references that exhausts the managed stack and raises a StackOverflowException, which is uncatch
A function operating on an array checks its type and base case (length == 0), but fails to enforce a maximum length limit or recursion depth limit. If this function is recursive, processing a deeply nested or excessively long array originating from untrusted input could lead to unbounded recursion, causing a stack overflow (DoS).
This tree destruction function recursively frees nodes without maintaining a depth counter. Deeply nested data structures can cause stack exhaustion leading to Denial of Service.
Uncontrolled mutual recursion (CWE-674) in standard parser combinators. The functions recursively call each other when parsing nested grammar elements without tracking recursion depth. An attacker can craft deeply nested inputs (such as repeating parenthesis) to exhaust the call stack, resulting in Denial of Service (DoS) via stack overflow.
RustCVE-2026-25727A new lookup node is created and processed without checking for CNAME loops, which could lead to unbounded recursion.
Dynamically dispatching recursive parsing operations using `methodcaller` can bypass recursion depth limits tracked in centralized parsing methods. This can lead to uncontrolled recursion (DoS). Ensure that nested structures are routed through methods that actively enforce recursion depth limits.
Uncontrolled recursion detected. The recursive function takes a depth parameter but does not validate it against a maximum threshold. A deeply nested structure could trigger stack exhaustion and lead to a Denial of Service (DoS).
A cycle detection mechanism was found that throws or returns upon detecting a duplicate, but lacks a corresponding limit on the collection's size. When this collection represents traversal depth or inclusion history, lacking a size bound can lead to Stack Exhaustion (CWE-674) or Uncontrolled Resource Consumption (CWE-400) via deeply nested structures. Enforc
Missing depth limit in recursive HTTP redirect handling. Recursively following HTTP redirects without maintaining and checking a recursion depth limit allows an attacker to cause an infinite redirect loop (DoS). Add a depth counter parameter and reject if it exceeds a maximum threshold.
A recursive parser instantiation drops the parent parser state. By using `new $CLASS(...)` inside its own class methods instead of using an internal subparser method, the new parser starts with reset resource limits (like depth counters or macro expansion limits). This can allow attackers to bypass Denial of Service (DoS) protections like recursion depth or
