---
title: Finding Critical Flaws in Secure Systems | Trail of Bits
description: Discover how common recursive processing of user input creates critical security vulnerabilities, even in security-conscious projects like ElasticSearch.
image: https://resources.trailofbits.com/hubfs/Screenshot%202024-12-17%20at%208.51.09%20PM.png
---

[![Trail of Bits logo](https://resources.trailofbits.com/hubfs/raw_assets/public/White%20paper%20landing%20page/Images/TOB_Logo_White.png)](https://trailofbits.com)

[Home](https://trailofbits.com)

[Services](https://trailofbits.com/services/software-assurance/)

- [Software Assurance](https://trailofbits.com/services/software-assurance/)
- [AI/ML](https://trailofbits.com/services/software-assurance/ai-ml/)
- [Application Security](https://trailofbits.com/services/software-assurance/appsec/)
- [Blockchain](https://trailofbits.com/services/software-assurance/blockchain/)
- [Cryptography](https://trailofbits.com/services/software-assurance/cryptography/)
- [Security Engineering](https://trailofbits.com/services/security-engineering/)
- [Research and Development](https://trailofbits.com/services/research-and-development/)

[Products](https://trailofbits.com/products/)

[Open Source](https://trailofbits.com/opensource/)

[Resources](https://trailofbits.com/resources/)

[Careers](https://trailofbits.com/careers/)

[About](https://trailofbits.com/about/)

[Blog](https://blog.trailofbits.com/)

[Contact](https://trailofbits.com/contact/)

# Finding Critical Flaws in Secure Systems

## Low-effort denial of service with recursion

 Using a simple CodeQL query, our team discovered that maliciously crafted inputs can crash systems that process user input recursively - a practice we found surprisingly common even among security-conscious projects like ElasticSearch, OpenSearch, and Google's Protocol Buffers. Our white paper covers:

- Why recursive processing of user input is a widespread security risk, even in sophisticated codebases
- How we discovered multiple CVEs in major projects using a simple CodeQL query
- Practical guidance on identifying and eliminating recursive vulnerabilities in your systems

Having trouble viewing the white paper? View it [here](https://resources.trailofbits.com/hubfs/Resources/trailofbits-20241218-recursion-whitepaper.pdf?hsLang=en)

###### ABOUT US

 Since 2012, Trail of Bits has helped secure the world's most targeted organizations and products. We combine high-end security research with a real-world attacker mentality to reduce risk and fortify code.

© Trail of Bits 2024. All rights reserved.

###### Connect with Us

[![Twitter icon](https://resources.trailofbits.com/hubfs/raw_assets/public/White%20paper%20landing%20page/Images/twitter-alt.svg) Twitter](https://twitter.com/trailofbits) [Careers](https://trailofbits.com/careers) [![LinkedIn icon](https://resources.trailofbits.com/hubfs/raw_assets/public/White%20paper%20landing%20page/Images/linkedin_square.svg) LinkedIn](https://www.linkedin.com/company/trail-of-bits) [Resources](https://trailofbits.com/) [![GitHub icon](https://resources.trailofbits.com/hubfs/raw_assets/public/White%20paper%20landing%20page/Images/github.svg) GitHub](https://github.com/trailofbits) [Blog](https://blog.trailofbits.com/)

###### Join our Newsletter

Stay informed about our latest work and industry news:

Email Address

Thanks! You're signed up!

Oops! Something went wrong while submitting the form.