Related examples that come up in the web domain include: (1) Zip bombs -- Do you accept compressed user content by first unzipping it and then examining the da

Related examples that come up in the web domain include: (1) Zip bombs -- Do you accept compressed user content by first unzipping it and then examining the data? Good luck with the OOM. (2) Catastrophic backtracking -- Are you still using regex to parse urls/emails? You're almost certainly using a library with worst-case exponential run-time rather than linear. And so on. If the natural way to solve a problem is self-referencing you're almost certainly going to expose yourself to exponential memory/time consumption for malicious inputs.