CWE-674
Allowed-with-ReviewUncontrolled Recursion
Abstraction: Class · Status: Draft
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
751 vulnerabilities reference this CWE, most recent first.
GHSA-7822-F4VJ-QH7P
Vulnerability from github – Published: 2024-04-01 00:30 – Updated: 2024-08-20 21:30LinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "" substring.
{
"affected": [],
"aliases": [
"CVE-2023-51803"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-01T00:15:49Z",
"severity": "CRITICAL"
},
"details": "LinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the \"\u003c?php ?\u003e\" substring.",
"id": "GHSA-7822-f4vj-qh7p",
"modified": "2024-08-20T21:30:30Z",
"published": "2024-04-01T00:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51803"
},
{
"type": "WEB",
"url": "https://github.com/linuxserver/Heimdall/pull/1167"
},
{
"type": "WEB",
"url": "https://github.com/linuxserver/Heimdall/pull/1173"
},
{
"type": "WEB",
"url": "https://github.com/linuxserver/Heimdall/releases/tag/v2.5.7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-78QJ-JPWW-M9RM
Vulnerability from github – Published: 2022-05-24 16:51 – Updated: 2024-04-04 01:22yaml-rust 0.4.0 and earlier is affected by: Uncontrolled Recursion. The impact is: Denial of service by impossible to catch abort. The component is: YamlLoader::load_from_str function. The attack vector is: Parsing of a malicious YAML document. The fixed version is: 0.4.1 and later.
{
"affected": [],
"aliases": [
"CVE-2019-1010182"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-25T14:15:00Z",
"severity": "MODERATE"
},
"details": "yaml-rust 0.4.0 and earlier is affected by: Uncontrolled Recursion. The impact is: Denial of service by impossible to catch abort. The component is: YamlLoader::load_from_str function. The attack vector is: Parsing of a malicious YAML document. The fixed version is: 0.4.1 and later.",
"id": "GHSA-78qj-jpww-m9rm",
"modified": "2024-04-04T01:22:06Z",
"published": "2022-05-24T16:51:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010182"
},
{
"type": "WEB",
"url": "https://github.com/chyh1990/yaml-rust/pull/109"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7997-F766-56H6
Vulnerability from github – Published: 2026-03-01 09:30 – Updated: 2026-03-01 09:30A vulnerability was detected in wren-lang wren up to 0.4.0. Affected is the function resolveLocal of the file src/vm/wren_compiler.c. The manipulation results in uncontrolled recursion. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-3385"
],
"database_specific": {
"cwe_ids": [
"CWE-404",
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-01T09:15:57Z",
"severity": "MODERATE"
},
"details": "A vulnerability was detected in wren-lang wren up to 0.4.0. Affected is the function resolveLocal of the file src/vm/wren_compiler.c. The manipulation results in uncontrolled recursion. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-7997-f766-56h6",
"modified": "2026-03-01T09:30:19Z",
"published": "2026-03-01T09:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3385"
},
{
"type": "WEB",
"url": "https://github.com/wren-lang/wren/issues/1218"
},
{
"type": "WEB",
"url": "https://github.com/oneafter/0122/blob/main/i1218/repro"
},
{
"type": "WEB",
"url": "https://github.com/wren-lang/wren"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.348271"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.348271"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.761305"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7C85-87CP-MR6G
Vulnerability from github – Published: 2025-05-10 15:30 – Updated: 2025-10-15 16:12A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ latest(v0.12.15). The vulnerability arises due to inappropriate secure coding measures, specifically the lack of proper implementation of the max_depth parameter in the get_article_urls function. This allows an attacker to exhaust Python's recursion limit through repeated function calls, leading to resource consumption and ultimately crashing the Python process.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "llama-index"
},
"ranges": [
{
"events": [
{
"introduced": "0.12.15"
},
{
"fixed": "0.12.21"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-1752"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-12T20:16:19Z",
"nvd_published_at": "2025-05-10T14:15:32Z",
"severity": "HIGH"
},
"details": "A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ latest(v0.12.15). The vulnerability arises due to inappropriate secure coding measures, specifically the lack of proper implementation of the max_depth parameter in the get_article_urls function. This allows an attacker to exhaust Python\u0027s recursion limit through repeated function calls, leading to resource consumption and ultimately crashing the Python process.",
"id": "GHSA-7c85-87cp-mr6g",
"modified": "2025-10-15T16:12:12Z",
"published": "2025-05-10T15:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1752"
},
{
"type": "WEB",
"url": "https://github.com/run-llama/llama_index/commit/3c65db2947271de3bd1927dc66a044da385de4da"
},
{
"type": "PACKAGE",
"url": "https://github.com/run-llama/llama_index"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/cd7b9082-7d75-42e4-84f5-dbee23cbc467"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "LlamaIndex Vulnerable to Denial of Service (DoS)"
}
GHSA-7G8H-GVX7-VXJC
Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-08-13 15:34In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX
adm1266_nvmem_read_blackbox() declares a 5-byte stack buffer and passes it to i2c_smbus_read_block_data() to retrieve the 4-byte BLACKBOX_INFO response. i2c_smbus_read_block_data() does not honour caller buffer sizes -- it memcpy()s data.block[0] bytes from the SMBus transaction (where data.block[0] is the length byte returned by the slave device, up to I2C_SMBUS_BLOCK_MAX = 32):
memcpy(values, &data.block[1], data.block[0]);
If the device returns any block length above 5, the call overflows the caller's 5-byte stack buffer before the post-call
if (ret != 4)
return -EIO;
check has a chance to reject the response.
Widen the local buffer to I2C_SMBUS_BLOCK_MAX so the helper has room for any well-formed SMBus block response, matching the convention used by the other i2c_smbus_read_block_data() callers in this driver.
{
"affected": [],
"aliases": [
"CVE-2026-64135"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-19T16:17:55Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX\n\nadm1266_nvmem_read_blackbox() declares a 5-byte stack buffer and\npasses it to i2c_smbus_read_block_data() to retrieve the 4-byte\nBLACKBOX_INFO response. i2c_smbus_read_block_data() does not honour\ncaller buffer sizes -- it memcpy()s data.block[0] bytes from the\nSMBus transaction (where data.block[0] is the length byte returned by\nthe slave device, up to I2C_SMBUS_BLOCK_MAX = 32):\n\n\tmemcpy(values, \u0026data.block[1], data.block[0]);\n\nIf the device returns any block length above 5, the call overflows\nthe caller\u0027s 5-byte stack buffer before the post-call\n\n\tif (ret != 4)\n\t\treturn -EIO;\n\ncheck has a chance to reject the response.\n\nWiden the local buffer to I2C_SMBUS_BLOCK_MAX so the helper has room\nfor any well-formed SMBus block response, matching the convention used\nby the other i2c_smbus_read_block_data() callers in this driver.",
"id": "GHSA-7g8h-gvx7-vxjc",
"modified": "2026-08-13T15:34:14Z",
"published": "2026-07-19T18:31:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64135"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0dbf64c502443c08c2e28a77ecbfcc5479d93228"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2b7a698d5093b548c464828d984f05ced5f3fd2a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/33251abb9c9dd62943be76f0427c5527ee39188f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6ed16a40b162e9d87d9ac8bed4d7f0e3e807700e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7f705e581ef3e6bb308a121a89adf5237d968204"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ba09f4baa5bd96c5d26c942defa546a72dbbe5bf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ca560f7566df7e2826c2999e959e6b94eb938f76"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/eee213daa1e1b402eb631bcd1b8c5aa340a6b081"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7GCJ-M465-HXG8
Vulnerability from github – Published: 2025-08-06 15:31 – Updated: 2025-08-06 15:31NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause uncontrolled recursion through a specially crafted input. A successful exploit of this vulnerability might lead to denial of service.
{
"affected": [],
"aliases": [
"CVE-2025-23325"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-06T13:15:40Z",
"severity": "HIGH"
},
"details": "NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause uncontrolled recursion through a specially crafted input. A successful exploit of this vulnerability might lead to denial of service.",
"id": "GHSA-7gcj-m465-hxg8",
"modified": "2025-08-06T15:31:25Z",
"published": "2025-08-06T15:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23325"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5687"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23325"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7GCM-G887-7QV7
Vulnerability from github – Published: 2026-01-23 15:31 – Updated: 2026-02-05 15:47A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.
Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.33.4"
},
"package": {
"ecosystem": "PyPI",
"name": "protobuf"
},
"ranges": [
{
"events": [
{
"introduced": "6.30.0rc1"
},
{
"fixed": "6.33.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "protobuf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.29.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-0994"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-23T16:56:33Z",
"nvd_published_at": "2026-01-23T15:16:06Z",
"severity": "HIGH"
},
"details": "A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.\n\nDue to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python\u2019s recursion stack and causing a RecursionError.",
"id": "GHSA-7gcm-g887-7qv7",
"modified": "2026-02-05T15:47:43Z",
"published": "2026-01-23T15:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0994"
},
{
"type": "WEB",
"url": "https://github.com/protocolbuffers/protobuf/issues/25070"
},
{
"type": "WEB",
"url": "https://github.com/protocolbuffers/protobuf/pull/25239"
},
{
"type": "WEB",
"url": "https://github.com/protocolbuffers/protobuf/commit/5ebddcb1bcbe51d1fe323baa145e85f4f23128cf"
},
{
"type": "WEB",
"url": "https://github.com/protocolbuffers/protobuf/commit/d2b001626d137c62dfee6c88c87324102531868b"
},
{
"type": "PACKAGE",
"url": "https://github.com/protocolbuffers/protobuf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
"type": "CVSS_V4"
}
],
"summary": "protobuf affected by a JSON recursion depth bypass"
}
GHSA-7HPJ-7HHX-2FGX
Vulnerability from github – Published: 2023-12-28 21:16 – Updated: 2024-01-10 18:34Impact
When decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop.
Patches
The fix is available in v1.10.1
Workarounds
Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.
References
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "msgpackr"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.10.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-52079"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2023-12-28T21:16:20Z",
"nvd_published_at": "2023-12-28T16:16:01Z",
"severity": "HIGH"
},
"details": "### Impact\nWhen decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop.\n\n### Patches\nThe fix is available in v1.10.1\n\n### Workarounds\nExploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.\n\n### References",
"id": "GHSA-7hpj-7hhx-2fgx",
"modified": "2024-01-10T18:34:21Z",
"published": "2023-12-28T21:16:20Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/kriszyp/msgpackr/security/advisories/GHSA-7hpj-7hhx-2fgx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52079"
},
{
"type": "WEB",
"url": "https://github.com/kriszyp/msgpackr/commit/18f44f8800e2261341cdf489d1ba1e35a0133602"
},
{
"type": "PACKAGE",
"url": "https://github.com/kriszyp/msgpackr"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "msgpackr\u0027s conversion of property names to strings can trigger infinite recursion"
}
GHSA-7HQX-W6MQ-G592
Vulnerability from github – Published: 2022-05-24 16:53 – Updated: 2024-02-03 03:30check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion.
{
"affected": [],
"aliases": [
"CVE-2019-15118"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-16T14:15:00Z",
"severity": "MODERATE"
},
"details": "check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion.",
"id": "GHSA-7hqx-w6mq-g592",
"modified": "2024-02-03T03:30:26Z",
"published": "2022-05-24T16:53:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15118"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git/commit/?id=19bce474c45be69a284ecee660aa12d8f1e88f18"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00000.html"
},
{
"type": "WEB",
"url": "https://lore.kernel.org/lkml/20190815043554.16623-1-benquike%40gmail.com"
},
{
"type": "WEB",
"url": "https://lore.kernel.org/lkml/20190815043554.16623-1-benquike@gmail.com"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Nov/11"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Sep/41"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190905-0002"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4147-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4162-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4162-2"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4163-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4163-2"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4531"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7JJC-F4W2-6G7W
Vulnerability from github – Published: 2024-04-03 00:30 – Updated: 2024-04-03 00:30In Xpdf 4.05 (and earlier), a PDF object loop in the attachments leads to infinite recursion and a stack overflow.
{
"affected": [],
"aliases": [
"CVE-2024-3248"
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-02T23:15:55Z",
"severity": "LOW"
},
"details": "In Xpdf 4.05 (and earlier), a PDF object loop in the attachments leads to infinite recursion and a stack overflow.\n",
"id": "GHSA-7jjc-f4w2-6g7w",
"modified": "2024-04-03T00:30:56Z",
"published": "2024-04-03T00:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3248"
},
{
"type": "WEB",
"url": "https://forum.xpdfreader.com/viewtopic.php?t=43657"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
Mitigation
Increase the stack size.
CAPEC-230: Serialized Data with Nested Payloads
Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization.
CAPEC-231: Oversized Serialized Data Payloads
An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.