Weaknesses of type CWE-606

49 results

Entrada não validada em condição de loop

Ocorre quando dados fornecidos pelo usuário (ou fonte externa) são usados diretamente na condição de um loop sem validação prévia. Um atacante pode manipular essa entrada para causar loops infinitos, consumir recursos excessivos ou desviar o fluxo de execução do programa.

Example

Um formulário web aceita um parâmetro 'quantidade' do usuário e usa `for(int i = 0; i < quantidade; i++)` sem verificar se quantidade é um número razoável. Um atacante envia quantidade = 2147483647 e tranca a aplicação em um loop infinito, indisponibilizando-a para outros usuários.

How to mitigate

Sempre validar e sanitizar entradas antes de usá-las em condições de loop: verificar se o valor está dentro de um intervalo aceitável, se é do tipo esperado e se não ultrapassa limites de timeout ou recursos. Use whitelist de valores válidos quando possível.

CVE-2026-44289HIGHprotobufjs: Denial of service through unbounded protobuf recursionEPSS 0.6%CVE-2025-65518HIGHPlesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the get_pasEPSS 0.6%CVE-2026-33891HIGHForge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero InputEPSS 0.6%CVE-2026-27145MEDIUMInefficient candidate hostname parsing in crypto/x509EPSS 0.6%CVE-2026-20301HIGHCisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service VulnerabilityEPSS 0.6%CVE-2026-55731MEDIUMLoytec LINX firmware: Unchecked input for loop condition in the SNMP agentEPSS 0.5%CVE-2026-71439MEDIUMMermaid radar diagrams are vulnerable to DoSEPSS 0.5%CVE-2026-85730HIGHsmol-toml: Denial of Service via malformed TOML documentsEPSS 0.5%CVE-2026-10143HIGHkafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.pyEPSS 0.5%CVE-2025-32399MEDIUMAn Unchecked Input for Loop Condition in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to cause IO devices that use the library EPSS 0.5%CVE-2026-16652HIGHTemporal Server Schedule exclusion search can cause excessive CPU consumptionEPSS 0.5%CVE-2024-13931HIGHAuthenticated Relative Path TraversalEPSS 0.4%CVE-2026-13761HIGHPega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.EPSS 0.4%CVE-2026-27689HIGHDenial of service (DOS) in SAP Supply Chain ManagementEPSS 0.4%CVE-2026-23689HIGHDenial of service (DOS) in SAP Supply Chain ManagementEPSS 0.4%CVE-2025-43801MEDIUMUnchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and LEPSS 0.4%CVE-2024-13930MEDIUMAuthenticated Unchecked Loop ConditionEPSS 0.4%CVE-2026-16599MEDIUMDenial of Service in GNU wgetEPSS 0.4%CVE-2026-107569HIGHUnchecked Input for Loop Condition in hMailServerEPSS 0.4%CVE-2025-42930MEDIUMDenial of Service (DoS) vulnerability in SAP Business Planning and ConsolidationEPSS 0.3%