← Home ← Codex ← DEBT
Browse by Category
+ added · updated 7d
← Back to glossary

Stack Overflow from Deep Recursion

PHP PHP 5.0+ Intermediate
debt(d8/e5/b3/t7)
d8 Detectability Operational debt — how invisible misuse is to your safety net

Closest to 'silent in production until users hit it' (d9), but phpstan can flag some recursive patterns and xdebug.max_nesting_level surfaces it in dev, so d8. The crash is uncatchable and depends on input depth, so it usually only manifests under adversarial or unusual inputs.

e5 Effort Remediation debt — work required to fix once spotted

Closest to 'touches multiple files / significant refactor in one component' (e5). Per quick_fix, converting recursion to iteration with SplStack is a real refactor of the algorithm, not a one-line swap — especially for tree traversal code.

b3 Burden Structural debt — long-term weight of choosing wrong

Closest to 'localised tax' (b3). Applies to specific recursive components (parsers, tree walkers), not the whole codebase. The choice to use recursion is local to those functions.

t7 Trap Cognitive debt — how counter-intuitive correct behaviour is

Closest to 'serious trap (contradicts how a similar concept works elsewhere)' (t7). Per misconception, devs expect a catchable exception like in many other languages/runtimes, but PHP segfaults or hits memory_limit uncatchably — directly contradicts the try/catch mental model PHP otherwise supports.

About DEBT scoring →

TL;DR

PHP has no configurable stack size limit — deep recursion causes a fatal segfault or memory exhaustion, not a catchable exception.

Explanation

PHP's call stack is limited by the OS stack size (typically 8MB on Linux). Deep recursion exhausts it and causes a segfault or memory_limit error — neither is catchable with try/catch. Practical limit is roughly 500–5000 nested calls depending on frame size. Solutions: convert tail-recursive functions to iterative loops, use a trampoline pattern, or process trees iteratively with an explicit stack (SplStack). xdebug.max_nesting_level (default 256) provides an earlier, catchable limit via E_ERROR.

Common Misconception

PHP will throw a catchable exception on stack overflow — it segfaults or hits memory_limit, both of which are uncatchable fatal errors.

Why It Matters

Recursive algorithms on user-supplied data (like parsing nested JSON or tree structures) can be exploited to crash PHP via stack exhaustion.

Common Mistakes

  • Recursive tree traversal without depth limit.
  • Not converting obvious tail recursion to iteration.
  • Setting xdebug.max_nesting_level too high — delays the crash.

Code Examples

✗ Vulnerable
function factorial(int $n): int {
    return $n <= 1 ? 1 : $n * factorial($n - 1);
}
factorial(100000); // Segfault
✓ Fixed
function factorial(int $n): int {
    $result = 1;
    for ($i = 2; $i <= $n; $i++) $result *= $i;
    return $result;
}

// Iterative tree traversal using explicit stack
function traverse(Node $root): void {
    $stack = new \SplStack();
    $stack->push($root);
    while (!$stack->isEmpty()) {
        $node = $stack->pop();
        process($node);
        foreach ($node->children as $child) $stack->push($child);
    }
}

Added 22 Mar 2026
Edited 13 Jun 2026
Views 42
Rate this term
No ratings yet
🤖 AI Guestbook educational data only
| |
Last 30 days
0 pings T 0 pings W 1 ping T 0 pings F 0 pings S 0 pings S 0 pings M 0 pings T 0 pings W 0 pings T 1 ping F 1 ping S 1 ping S 0 pings M 0 pings T 2 pings W 0 pings T 1 ping F 0 pings S 0 pings S 0 pings M 0 pings T 0 pings W 0 pings T 0 pings F 0 pings S 4 pings S 0 pings M 0 pings T 0 pings W
No pings yet today
No pings yesterday
Amazonbot 9 Scrapy 5 ChatGPT 4 Perplexity 4 Google 4 Unknown AI 3 Ahrefs 3 Meta AI 2 Claude 2 Bing 1 PetalBot 1
crawler 33 crawler_json 4 pre-tracking 1
DEV INTEL Tools & Severity
🟠 High ⚙ Fix effort: Medium
⚡ Quick Fix
Convert recursive functions to iterative using SplStack or a while loop. Set xdebug.max_nesting_level=500 to get an early catchable error in dev.
📦 Applies To
PHP 5.0+ web cli queue-worker
🔗 Prerequisites
🔍 Detection Hints
function.*\(.*\).*{[^}]*\$.*\(
Auto-detectable: ✗ No phpstan
⚠ Related Problems
🤖 AI Agent
Confidence: Medium False Positives: Medium ✗ Manual fix Fix: High Context: Function Tests: Update
CWE-674 CWE-400

✓ schema.org compliant