CWE-674

661 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 7High 320Medium 308Low 25Not scored 1

CVEs per yearBy the year they were published

CVE-2026-121092
Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a…
Google · Chrome
High8.8
CVE-2026-63475
isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)
isomorphic-git · isomorphic-git
Medium4.3
CVE-2026-115290
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Elastic · Elasticsearch
High7.5
CVE-2026-121423
SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization
surrealdb · surrealdb
High7.1
CVE-2026-120689
Uncontrolled Recursion in HDF5 H5B__iterate_helper() via Crafted File
The HDF Group · HDF5
Medium4.3
CVE-2026-101180
DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.
Huawei · HarmonyOS
Medium4.3
CVE-2026-120135
Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default
Apache Software Foundation · Apache Thrift
High8.2
CVE-2026-62303
Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)
pistacheio · pistache
Medium5.9
CVE-2026-61847
Crass: A large number of adjacent CSS comments can trigger a SystemStackError
rgrove · crass
Medium6.3
CVE-2026-61846
Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
rgrove · crass
Medium6.3