CWE-674 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-674 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
CVE-2026-58280Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.1.1%높음7.5CVE-2026-69378Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service …1.1%높음7.5CVE-2026-61551Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply ne…0.9%높음8.6CVE-2026-93450go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON pars…0.9%높음8.7CVE-2026-91863A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nestin…0.8%높음7.5CVE-2026-93687braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack …0.7%높음8.7CVE-2026-116011Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows…0.7%높음8.7CVE-2026-65651temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a corresp…0.7%높음8.7
전체 목록
120건
CVE-2026-93435redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows …0.6%높음8.7
CVE-2026-120135Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before …0.6%높음8.2
CVE-2026-82230Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows re…0.5%높음7.5
CVE-2026-119762Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated…0.5%높음8.7
CVE-2026-109449In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the Expressi…0.5%높음8.7
CVE-2026-52852Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manag…0.5%보통6.5
CVE-2026-109413In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recurse…0.5%높음8.7
CVE-2026-54451Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that dec…0.5%높음8.2
CVE-2026-61847Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, w…0.5%보통6.3
CVE-2026-61846Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, C…0.5%보통6.3
CVE-2026-91765cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthen…0.5%높음7.5
CVE-2026-107826OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, …0.5%높음7.5
CVE-2026-53752docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX…0.4%높음7.5
CVE-2026-95861A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in ce…0.5%높음7.5
CVE-2026-107376webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\P…0.4%높음8.2
CVE-2026-119191Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to …0.4%높음7.5
CVE-2026-100354kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direc…0.4%높음7.5
CVE-2026-104020Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticat…0.4%높음8.7
CVE-2026-119187Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to …0.4%높음7.5
CVE-2026-107300msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder rec…0.4%높음7.5
CVE-2026-19248QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untru…0.4%높음7.1
CVE-2026-109267ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an…0.4%보통6.9
CVE-2026-96289Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0…0.4%높음8.2
CVE-2026-96288Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Er…0.4%높음8.2
CVE-2026-85493Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thr…0.4%높음8.7
CVE-2026-94650Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: befor…0.4%높음8.2
CVE-2026-83663Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a …0.4%높음8.7
CVE-2026-95179An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of servic…0.4%높음7.5
CVE-2026-119137Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows gue…0.4%보통6.9
CVE-2026-103006Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deepl…0.4%보통6.5
CVE-2026-8168Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attac…0.4%높음7.1
CVE-2026-109264ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that c…0.4%보통6.3
CVE-2026-12358IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient vali…0.4%높음7.5
CVE-2026-102509Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursio…0.4%높음8.7
CVE-2026-118036In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infi…0.4%높음7.5
CVE-2026-73321XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authen…0.4%높음7.1
CVE-2026-44031Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK…0.4%높음8.7
CVE-2026-107833OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, …0.4%보통5.9
CVE-2026-59156OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant …0.4%보통6.5
CVE-2026-104635Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthentic…0.4%높음8.2
CVE-2026-89418google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can se…0.4%높음8.7
CVE-2026-106572ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-…0.4%보통5.3
CVE-2026-116871Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSub…0.4%높음8.7
CVE-2026-91968vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that acc…0.4%높음7.1
CVE-2026-55862pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml D…0.4%보통6.5
CVE-2026-107298msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decodin…0.4%보통5.3
CVE-2026-102281Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a sing…0.4%높음7.5
CVE-2026-119123ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the D…0.4%보통6.3
CVE-2026-106447StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor de…0.4%높음8.7
CVE-2026-77465toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 genera…0.4%높음7.5
CVE-2026-61811Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud wo…0.4%보통6.5
CVE-2026-111923Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsin…0.4%높음8.7
CVE-2026-102495Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can…0.4%높음7.5
CVE-2026-102497The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, …0.4%높음7.5
CVE-2026-102496Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so …0.4%높음7.5
CVE-2026-88858A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expressio…0.3%보통6.5
CVE-2026-63386js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load() does not bound nesting or dotted-key depth in …0.4%보통5.3
CVE-2026-95844Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names …0.4%높음8.7
CVE-2026-84851An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthe…0.3%높음8.7
CVE-2026-114605dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled D…0.3%높음7.5
CVE-2026-119542A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can caus…0.3%보통4.3
CVE-2026-95155FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allo…0.3%높음7.5
CVE-2026-102276The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19…0.4%높음7.5
CVE-2026-102278The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20…0.4%높음7.5
CVE-2026-90472msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recu…0.3%보통6.9
CVE-2026-110974The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth l…0.3%보통6.3
CVE-2026-106449yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream config…0.3%낮음3.7
CVE-2026-11573Uncontrolled recursion in Qt's QDomDocument serialization (QtXml) lets deeply nested untrusted XML crash the a…0.3%높음7.1
CVE-2026-62303Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanit…0.3%보통5.9
CVE-2026-102510Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excess…0.3%높음8.7
CVE-2026-103087Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3…0.3%높음7.1
CVE-2026-92876IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a …0.3%높음7.5
CVE-2026-90912IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to …0.3%높음7.5
CVE-2026-103600Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Legion of the Bouncy Castle …0.3%높음8.7
CVE-2026-107216Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, …0.3%높음7.5
CVE-2026-103008Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted reques…0.3%보통6.5
CVE-2026-66282In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function …0.3%보통6.0
CVE-2026-118035In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inef…0.3%높음7.5
CVE-2026-116586Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, inc…0.3%보통6.9
CVE-2026-113650ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> i…0.3%보통5.3
CVE-2026-102409Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to termi…0.3%보통6.5
CVE-2026-107208ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-…0.3%보통5.3
CVE-2026-112895Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an exi…0.3%높음8.7
CVE-2026-19201An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions…0.3%보통6.6
CVE-2026-103118A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function Ex…0.3%보통5.3
CVE-2026-118037In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infi…0.3%높음7.5
CVE-2026-102265PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api…0.3%보통5.3
CVE-2026-19498IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allo…0.3%높음7.5
CVE-2026-68914Mojolicious is a real-time web framework for Perl. Prior to 9.47, the pure-Perl implementation of Mojo::JSON d…0.3%높음8.7
CVE-2026-22591eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object M…0.3%높음7.5
CVE-2026-54425Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cau…0.3%미평가
CVE-2026-112368An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthent…0.3%높음8.2
CVE-2026-66858The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a …0.3%높음8.7
CVE-2026-88763A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide sec…0.3%보통5.9
CVE-2026-78253Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denia…0.3%낮음2.3
CVE-2026-100702Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, an…0.3%높음8.2
CVE-2026-105042A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a cra…0.2%미평가
CVE-2026-92822A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant…0.2%보통6.2
CVE-2026-119371SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMI…0.2%보통6.8
CVE-2026-92564A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to…0.2%미평가
CVE-2026-119376SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMI…0.2%보통6.8
CVE-2026-120689HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. Whe…0.2%보통4.3
CVE-2026-110673Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tag…0.2%미평가
CVE-2026-110259OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions…0.2%보통6.8
CVE-2026-110263OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that a…0.2%보통6.8
CVE-2026-54427Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC pro…0.2%미평가
CVE-2026-75655Bridge is affected by an Uncontrolled Recursion vulnerability that could result in arbitrary code execution in…0.2%높음7.8
CVE-2026-101180DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect…0.2%보통4.3
CVE-2026-54426Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to …0.2%미평가
CVE-2026-108331Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.0.1%낮음3.3
CVE-2026-65628jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives an ECDH shared secret from tw…0.1%보통5.9
CVE-2026-59168Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0…0.1%보통6.2
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.