🎯 New Report #4022462: Uncaught RecursionError crash in translation-finder (deep directory tree DoS)
🔺Severity: Low
👽 Reporter: sumit-sabhaya
⭐️ Reputation: 229
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-09-11
⏰ Disclosed: 2026-10-14 11:53:42
📝 Summary: A denial of service vulnerability was discovered in a translation discovery tool where uncaught recursion errors could crash processing during repository scanning. The issue occurred when scanning directories nested approximately 1000 levels deep, which exceeded the Python recursion limit and resulted in an unhandled RecursionError exception. The vulnerability affected the discovery function used for import, update, and webhook operations. The error was not caught by existing exception handlers, causing the entire discovery call to fail repeatedly. The issue was caused by recursive directory traversal without depth limiting or proper exception handling. A fix was implemented by adding RecursionError to the exception handler to gracefully skip problematic subtrees instead of crashing.
📂 Report JSON File: 4022462
@hackeronereports