CWE-674: Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
How it's found
Uncontrolled Recursion describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
Vulnerable vs. safe
... // Do some real work here, but the value of flg is unmodifiedif (flg) { do_something_recursive (flg); } // flg is never modified so it is always TRUE - this call will continue until the stack explodesvoid do_something_recursive (int flg){}int flag = 1; // Set to TRUEdo_something_recursive (flag);... // Do some real work here// Modify value of flg on done conditionif (flg) { do_something_recursive (flg); } // returns when flg changes to 0void do_something_recursive (int flg){}int flag = 1; // Set to TRUEdo_something_recursive (flag);Consequences
- DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory): Resources including CPU, memory, and stack memory could be rapidly consumed or exhausted, eventually leading to an exit or crash.
- Read Application Data: In some cases, an application's interpreter might kill a process or thread that appears to be consuming too much resources, such as with PHP's memory_limit setting. When the interpreter kills the process/thread, it might report an error containing detailed information such as the application's installation path.
Mitigations
- Implementation: Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
- Implementation: Increase the stack size.
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-674?
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
How do you find Uncontrolled Recursion?
Uncontrolled Recursion describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
What is the impact of CWE-674?
DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory): Resources including CPU, memory, and stack memory could be rapidly consumed or exhausted, eventually leading to an exit or crash. Read Application Data: In some cases, an application's interpreter might kill a process or thread that appears to be consuming too much resources, such as with PHP's memory_limit setting. When the interpreter kills the process/thread, it might report an error containing detailed information such as the application's installation path.
Does TurboPentest test for Uncontrolled Recursion?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
- Class weaknessCWE-834: Excessive Iteration
- Variant weaknessCWE-48: Path Equivalence: 'file name' (Internal Whitespace)
- Base weaknessCWE-170: Improper Null Termination
- Base weaknessCWE-369: Divide By Zero
- Variant weaknessCWE-382: J2EE Bad Practices: Use of System.exit()
- Class weaknessCWE-400: Uncontrolled Resource Consumption
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest