What is Uncontrolled Recursion (CWE-674)?

TL;DR: Uncontrolled Recursion (CWE-674) is a vulnerability where a program does not limit the depth of recursive calls, leading to resource exhaustion. It can be mitigated by implementing proper exit conditions in recursive functions.

What is Uncontrolled Recursion?

Uncontrolled Recursion (CWE-674) is a type of vulnerability where a program does not properly control the amount of recursion that takes place, leading to excessive resource consumption such as allocated memory or stack usage. As defined by the MITRE Corporation under CWE-674, and classified by the OWASP Foundation under [no official mapping]…

Quick Summary

Uncontrolled Recursion is a critical vulnerability where recursive function calls are not properly controlled, leading to potential system crashes due to resource exhaustion. This can cause significant business impacts such as financial losses from downtime and reputational damage.

Jump to: Quick Summary · Uncontrolled Recursion Overview · How Uncontrolled Recursion Works · Business Impact of Uncontrolled Recursion · Uncontrolled Recursion Attack Scenario · How to Detect Uncontrolled Recursion · How to Fix Uncontrolled Recursion · Framework-Specific Fixes for Uncontrolled Recursion · How to Ask AI to Check Your Code for Uncontrolled Recursion · Uncontrolled Recursion Best Practices Checklist · Uncontrolled Recursion FAQ · Vulnerabilities Related to Uncontrolled Recursion · References · Scan Your Own Site

Uncontrolled Recursion Overview

What

Uncontrolled Recursion occurs when a program does not limit the depth of recursive calls, leading to excessive resource consumption and potential system crashes.

Why it matters

This vulnerability can cause stack overflow or memory exhaustion, resulting in application crashes and denial-of-service conditions.

Where it occurs

It commonly appears in backend languages where functions call themselves repeatedly without proper termination conditions.

Who is affected

Developers who write recursive algorithms without proper exit conditions are at risk of introducing this vulnerability.

Who is NOT affected

Applications that strictly control recursion depth or use non-recursive alternatives for iterative processes.

How Uncontrolled Recursion Works

Root Cause

The root cause is the absence of a base case in recursive functions, allowing them to continue indefinitely and consume excessive resources.

Attack Flow

1. An attacker identifies a function with unbounded recursion.
2. The attacker manipulates input parameters to trigger deep recursive calls.
3. Recursive calls exceed stack or memory limits, causing resource exhaustion.
4. Application crashes due to insufficient resources.

   Prerequisites to Exploit

   • A function that recursively processes data without proper termination conditions.
   • An attacker who can manipulate input parameters to trigger deep recursion.

     Vulnerable Code

     def recursive_function(n):
      if n > 0:
        return recursive_function(n - 1)
     

     This code does not have a base case and will continue calling itself indefinitely.

Secure Code

def safe_recursive_function(n, max_depth=1000):
    if n <= max_depth:
        return safe_recursive_function(n - 1) if n > 0 else 0
    else:
        raise ValueError("Recursion depth exceeded")

This code includes a base case that stops further recursive calls when the recursion depth exceeds a predefined limit.

Business Impact of Uncontrolled Recursion

Availability

• Stack overflow: Recursive functions can exhaust stack space, causing application crashes.
• Memory exhaustion: Deep recursion may consume excessive memory, leading to system instability and crashes.
• Denial-of-service (DoS): Resource consumption by uncontrolled recursion can prevent legitimate users from accessing the service.

Confidentiality

• In some cases, an interpreter might report detailed error information containing sensitive data when killing a process due to resource exhaustion.

Uncontrolled Recursion Attack Scenario

1. An attacker identifies a function that calls itself recursively without proper termination conditions.
2. The attacker manipulates input parameters to trigger deep recursive calls.
3. Recursive calls exceed stack or memory limits, causing resource exhaustion.
4. Application crashes due to insufficient resources.
5. Legitimate users are unable to access the service due to system instability.

How to Detect Uncontrolled Recursion

Manual Testing

• Identify functions that call themselves recursively without proper termination conditions.
• Test recursive functions with large input parameters to observe resource consumption behavior.
• Verify that recursive calls have a base case and do not exceed predefined depth limits.

  Automated Scanners (SAST / DAST)

  Static analysis tools can detect potential uncontrolled recursion by identifying functions lacking proper exit conditions. Dynamic testing is necessary to confirm actual resource exhaustion in runtime scenarios.

  PenScan Detection

  PenScan’s scanner engines such as ZAP, Nuclei, Wapiti, Nikto, SSLyze, Dalfox, and Nmap can identify potential recursive functions without proper termination conditions.

  False Positive Guidance

  A false positive may occur if a function has a base case but is not called frequently enough to trigger resource exhaustion during testing.

How to Fix Uncontrolled Recursion

• Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep.
• Increase the stack size to mitigate potential issues caused by unbounded recursion, though this is not a primary fix.

Framework-Specific Fixes for Uncontrolled Recursion

Python/Django

def safe_recursive_function(n, max_depth=1000):
    if n <= max_depth:
        return safe_recursive_function(n - 1) if n > 0 else 0
    else:
        raise ValueError("Recursion depth exceeded")

This code includes a base case that stops further recursive calls when the recursion depth exceeds a predefined limit.

How to Ask AI to Check Your Code for Uncontrolled Recursion

Uncontrolled Recursion Best Practices Checklist

✅ Ensure recursive functions have a base case that stops further calls when certain conditions are met. ✅ Limit recursion depth to prevent excessive resource consumption. ✅ Increase stack size as a secondary mitigation, but not the primary fix. ✅ Test recursive functions with large input parameters to observe behavior. ✅ Implement error handling for cases where recursion exceeds predefined limits.

Uncontrolled Recursion FAQ

How does uncontrolled recursion occur in code?

Uncontrolled recursion happens when a function calls itself repeatedly without a proper exit condition, leading to excessive resource consumption.

What are the typical consequences of uncontrolled recursion?

It can lead to stack overflow or memory exhaustion, causing application crashes and denial-of-service conditions.

How can developers prevent uncontrolled recursion in their code?

Implement a base case that stops further recursive calls when certain conditions are met, such as limiting the depth of recursion.

What is an example of vulnerable code for uncontrolled recursion?

A function that recursively processes data without checking if it should stop can lead to uncontrolled recursion and resource exhaustion.

How does PenScan detect uncontrolled recursion vulnerabilities?

PenScan uses static analysis tools like ZAP, Nuclei, Wapiti, Nikto, SSLyze, Dalfox, and Nmap to identify potential recursive functions without proper termination conditions.

What are the common business impacts of uncontrolled recursion?

Uncontrolled recursion can cause financial losses due to system downtime, compliance issues from data breaches, and damage to reputation.

How does an attacker exploit uncontrolled recursion in a real-world scenario?

An attacker may trigger recursive calls by manipulating input parameters or exploiting logic flaws in the code.

Vulnerabilities Related to Uncontrolled Recursion

| CWE | Name | Relationship | |—|—|—| | CWE-834 | Excessive Iteration | ChildOf |

References

• MITRE
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Uncontrolled Recursion and other risks before an attacker does.