CWE-674Uncontrolled Recursion

Abstraction: Class · CVEs in our corpus: 510

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Last updated: 22 August 2026 20:22 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 2 mapping(s) from 1 framework(s): CAPEC 2 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

CP-7 Alternate Processing Site
SC-5 Denial-of-service Protection
PR.PS-06
ID.RA-01

Detect

Catch it (CSF Detect / Respond)

DE.CM-09

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (2)AI-assisted

Control	Title	Family	Why it addresses this CWE
`CP-7`	Alternate Processing Site	CP	Supports resumption at alternate site when uncontrolled recursion causes primary site failure or crash.
`SC-5`	Denial-of-service Protection	SC	Prevents uncontrolled recursion that exhausts stack or CPU resources.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2024-25111`	8.6	8.6	0.6525	2024-03-06
`CVE-2023-50269`	8.5	8.6	0.5763	2023-12-14
`CVE-2018-1000618`	7.6	9.8	0.0153	2018-07-09
`CVE-2021-42697`	7.5	7.5	0.3614	2021-11-02
`CVE-2021-41752`	7.5	9.8	0.0120	2022-04-05
`CVE-2023-51803`	7.4	9.8	0.0070	2024-04-01
`CVE-2026-43185`	7.4	9.8	0.0062	2026-05-06
`CVE-2021-45105`	7.3	5.9	1.0000	2021-12-18
`CVE-2019-9543`	7.1	8.8	0.0331	2019-03-01
`CVE-2022-41966`	7.1	8.2	0.0869	2022-12-28
`CVE-2007-1285`	7.0	7.5	0.1816	2007-03-06
`CVE-2019-9143`	7.0	8.8	0.0277	2019-02-25
`CVE-2019-9144`	7.0	8.8	0.0278	2019-02-25
`CVE-2026-40324`	7.0	9.1	0.0090	2026-04-18
`CVE-2019-9545`	6.9	8.8	0.0182	2019-03-01
`CVE-2026-32327`	6.9	9.1	0.0048	2026-08-06
`CVE-2020-8285`	6.7	7.5	0.0992	2020-12-14
`CVE-2022-24675`	6.7	7.5	0.0995	2022-04-20
`CVE-2016-3627`	6.6	7.5	0.0703	2016-05-17
`CVE-2023-22617`	6.6	7.5	0.0732	2023-01-21
`CVE-2024-37973`	6.6	8.8	0.0065	2024-07-09
`CVE-2016-9597`	6.5	7.5	0.0448	2018-07-30
`CVE-2019-1003011`	6.5	8.1	0.0204	2019-02-06
`CVE-2018-20796`	6.5	7.5	0.0576	2019-02-26
`CVE-2020-12100`	6.5	7.5	0.0522	2020-08-12