Don’t recurse on untrusted input

Summary: Trail of Bits researchers found that a single malicious request can crash web applications that use recursive functions to process untrusted input, and used a CodeQL query to identify denial-of-service vulnerabilities in several high-profile Java projects. The research includes CVE-2024-7254 in Google's Protobuf library, where an attacker can throw a StackOverflowError in the Java lite version by sending one message that nests unknown groups, and the same issue applied to Rust-protobuf.
What's compelling: The affected projects are maintained by security-conscious organizations with robust development practices, so if they were vulnerable, your code may carry the same recursion flaw. A server-side stack overflow can take down critical services even with DDoS protection in place.

Read the original at Trail of Bits Blog ↗

Mentions: CVE-2024-7254