Weaknesses of type CWE-834

36 results

Iteração excessiva

Ocorre quando um loop ou processo recursivo não tem um limite adequado de iterações, permitindo que execute indefinidamente ou por um tempo muito longo. Isso consome recursos do sistema (CPU, memória) até causar negação de serviço, travamento ou crash da aplicação.

Example

Um parser XML que processa nós aninhados sem verificar a profundidade máxima: um arquivo malicioso com milhares de camadas consegue travar o parser em poucos segundos. Outro caso: um algoritmo de busca que não limita tentativas e entra em loop infinito quando dados estão malformados.

How to mitigate

Implemente sempre um limite explícito: contador que para a iteração, timeout para loops longos, ou validação de profundidade/tamanho antes de processar. Teste com entradas adversariais (dados muito grandes, aninhados ou malformados) para confirmar que o código não entra em consumo desenfreado de recursos.

CVE-2021-35515—Apache Commons Compress 1.6 to 1.20 denial of service vulnerabilityEPSS 11.6%CVE-2023-1993MEDIUMLISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture fEPSS 4.1%CVE-2021-31812—A carefully crafted PDF file can trigger an infinite loop while loading the fileEPSS 3.1%CVE-2021-27807—A carefully crafted PDF file can trigger an infinite loop while loading the fileEPSS 3.0%CVE-2019-3565—Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown EPSS 2.8%CVE-2019-3558—Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious cliEPSS 2.0%CVE-2019-3559—Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clienEPSS 2.0%CVE-2019-3564—Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clientsEPSS 2.0%CVE-2019-3552—C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malEPSS 2.0%CVE-2021-39204HIGHExcessive CPU usage in PomeriumEPSS 1.7%CVE-2023-26513HIGHApache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoSEPSS 1.5%CVE-2018-20805MEDIUMInvariant with $elemMatchEPSS 1.2%CVE-2021-32778MEDIUMExcessive CPU utilization when closing HTTP/2 streamsEPSS 1.2%CVE-2024-4603MEDIUMExcessive time spent checking DSA keys and parametersEPSS 1.1%CVE-2023-0411MEDIUMExcessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or EPSS 0.9%CVE-2023-4043MEDIUMParsson DoS when parsing numbers from untrusted sourcesEPSS 0.8%CVE-2024-4227HIGHgSOAP: Vulnerable to specially crafted unencrypted SDC messagesEPSS 0.7%CVE-2023-5632HIGHUnconditionally adding an event to the epoll causes excessive CPU consumptionEPSS 0.7%CVE-2026-64641HIGHNext.js: Denial of Service in App Router using Server ActionsEPSS 0.6%CVE-2025-67726HIGHTornado is Vulnerable to Quadratic DoS via Crafted Multipart ParametersEPSS 0.5%