You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by "elharo (via GitHub)" <gi...@apache.org> on 2026/08/02 11:00:03 UTC
[I] StackOverflowError from recursive dependency graph build/traversal (deep chains) [maven-dependency-tree]
elharo opened a new issue, #130:
URL: https://github.com/apache/maven-dependency-tree/issues/130
## Summary
The dependency graph is built and traversed recursively, so a deeply nested dependency chain can crash the JVM with a `StackOverflowError` instead of failing gracefully.
## Affected code
- `DefaultDependencyNode.accept(...)` recurses over children: `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyNode.java:104-114`
- `DefaultDependencyCollectorBuilder.buildDependencyNode(...)` recurses per node: `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyCollectorBuilder.java:225-231`
- `DefaultDependencyGraphBuilder.buildDependencyNode(...)`: `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyGraphBuilder.java:153-158`
- `BuildingDependencyNodeVisitor.endVisit(...)` re-applies the visitor via `rootNode.accept(...)`: `src/main/java/org/apache/maven/shared/dependency/graph/traversal/BuildingDependencyNodeVisitor.java:111-113`
## Impact
Because this library backs `mvn dependency:tree` / `dependency:analyze`, a crafted or pathological deep chain (thousands of levels) will overflow the stack. This is an availability / denial-of-service concern when running against untrusted or generated POMs, and even legitimate large projects can hit it.
## Suggested fix
Rewrite the traversal iteratively (explicit stack), or at least convert the deepest recursion (`accept`) to an iterative pre-order/post-order walk.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] StackOverflowError from recursive dependency graph build/traversal (deep chains) [maven-dependency-tree]
Posted by "slachiewicz (via GitHub)" <gi...@apache.org>.
slachiewicz commented on issue #130:
URL: https://github.com/apache/maven-dependency-tree/issues/130#issuecomment-6004154939
Closing: maven-dependency-tree is no longer used by any Apache Maven component and is planned for retirement, tracked in #150 ([vote](https://lists.apache.org/thread/xvqh2pjm8zq6k2h6kogzlksv37rzkcbx)). No further releases are planned. To migrate, call Maven Resolver directly, as #150 describes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] StackOverflowError from recursive dependency graph build/traversal (deep chains) [maven-dependency-tree]
Posted by "slachiewicz (via GitHub)" <gi...@apache.org>.
slachiewicz closed issue #130: StackOverflowError from recursive dependency graph build/traversal (deep chains)
URL: https://github.com/apache/maven-dependency-tree/issues/130
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org