Weaknesses of type CWE-606

45 results

Entrada não validada em condição de loop

Ocorre quando dados fornecidos pelo usuário (ou fonte externa) são usados diretamente na condição de um loop sem validação prévia. Um atacante pode manipular essa entrada para causar loops infinitos, consumir recursos excessivos ou desviar o fluxo de execução do programa.

Example

Um formulário web aceita um parâmetro 'quantidade' do usuário e usa `for(int i = 0; i < quantidade; i++)` sem verificar se quantidade é um número razoável. Um atacante envia quantidade = 2147483647 e tranca a aplicação em um loop infinito, indisponibilizando-a para outros usuários.

How to mitigate

Sempre validar e sanitizar entradas antes de usá-las em condições de loop: verificar se o valor está dentro de um intervalo aceitável, se é do tipo esperado e se não ultrapassa limites de timeout ou recursos. Use whitelist de valores válidos quando possível.

CVE-2026-10143HIGHkafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.pyEPSS 0.5%CVE-2025-32399MEDIUMAn Unchecked Input for Loop Condition in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to cause IO devices that use the library EPSS 0.5%CVE-2026-11972HIGHtarfile opened in streaming mode mishandles EOFEPSS 0.4%CVE-2026-71439MEDIUMMermaid radar diagrams are vulnerable to DoSEPSS 0.4%CVE-2026-66276MEDIUMApache Qpid Proton-J: Unbounded disposition range handling can lead to denial of serviceEPSS 0.4%CVE-2026-68077MEDIUMApache Qpid Broker-J: Unbounded disposition range handling can lead to denial of serviceEPSS 0.4%CVE-2024-13931HIGHAuthenticated Relative Path TraversalEPSS 0.4%CVE-2026-67554MEDIUMApache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of serviceEPSS 0.4%CVE-2025-43801MEDIUMUnchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and LEPSS 0.4%CVE-2026-85730HIGHsmol-toml: Denial of Service via malformed TOML documentsEPSS 0.4%CVE-2026-16599MEDIUMDenial of Service in GNU wgetEPSS 0.4%CVE-2024-13930MEDIUMAuthenticated Unchecked Loop ConditionEPSS 0.4%CVE-2026-23689HIGHDenial of service (DOS) in SAP Supply Chain ManagementEPSS 0.4%CVE-2026-27689HIGHDenial of service (DOS) in SAP Supply Chain ManagementEPSS 0.4%CVE-2026-20301HIGHCisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service VulnerabilityEPSS 0.3%CVE-2026-55731MEDIUMLoytec LINX firmware: Unchecked input for loop condition in the SNMP agentEPSS 0.3%CVE-2025-42930MEDIUMDenial of Service (DoS) vulnerability in SAP Business Planning and ConsolidationEPSS 0.3%CVE-2026-33800HIGHJunos OS: MX Series: In a VC scenario a high rate of micro-BFD session flaps will cause an FPC crashEPSS 0.3%CVE-2026-16652HIGHTemporal Server Schedule exclusion search can cause excessive CPU consumptionEPSS 0.3%CVE-2026-13761HIGHPega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.EPSS 0.3%