1633
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Alternate Terms
Stack Exhaustion :
Common Consequences
Scope Impact Likelihood
Availability DoS: Resource Consumption (CPU)
DoS: Resource Consumption (Memory)
Resources including CPU, memory, and stack memory
could be rapidly consumed or exhausted, eventually
leading to an exit or crash.
Confidentiality Read Application Data
In some cases, an application's interpreter might kill a
process or thread that appears to be consuming too much
resources, such as with PHP's memory_limit setting.
When the interpreter kills the process/thread, it might
report an error containing detailed information such as the
application's installation path.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
CWE Version 4.14
CWE-674: Uncontrolled Recursion
CWE-674: Uncontrolled Recursion