Fallos del tipo CWE-606
45 resultadosEntrada não validada em condição de loop
Ocorre quando a condição de um laço (for, while) depende de entrada do usuário sem validação prévia. Um atacante pode fornecer valores que causam loops infinitos, consumo excessivo de CPU/memória ou bypass de lógica de segurança. O risco é ainda maior em contextos sensíveis como processamento de requisições web.
Ejemplo
Um servidor aceita um parâmetro 'quantidade' via GET sem validar, usa direto em `for(int i=0; i<quantidade; i++)`. Um atacante envia quantidade=999999999, travando a thread e causando negação de serviço.
Cómo mitigar
Sempre validar e sanitizar entrada do usuário antes de usá-la em condições de loop; estabelecer limites máximos razoáveis e aplicá-los (ex: `Math.min(quantidade, MAX_LIMIT)`); usar timeouts em operações críticas.
CVE-2026-10143HIGHkafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.pyEPSS 0.5%CVE-2025-32399MEDIUMAn Unchecked Input for Loop Condition in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to cause IO devices that use the library EPSS 0.5%CVE-2026-11972HIGHtarfile opened in streaming mode mishandles EOFEPSS 0.4%CVE-2026-71439MEDIUMMermaid radar diagrams are vulnerable to DoSEPSS 0.4%CVE-2026-66276MEDIUMApache Qpid Proton-J: Unbounded disposition range handling can lead to denial of serviceEPSS 0.4%CVE-2026-68077MEDIUMApache Qpid Broker-J: Unbounded disposition range handling can lead to denial of serviceEPSS 0.4%CVE-2024-13931HIGHAuthenticated Relative Path TraversalEPSS 0.4%CVE-2026-67554MEDIUMApache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of serviceEPSS 0.4%CVE-2025-43801MEDIUMUnchecked input for loop condition vulnerability in XML-RPC in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and LEPSS 0.4%CVE-2026-85730HIGHsmol-toml: Denial of Service via malformed TOML documentsEPSS 0.4%CVE-2026-16599MEDIUMDenial of Service in GNU wgetEPSS 0.4%CVE-2024-13930MEDIUMAuthenticated Unchecked Loop ConditionEPSS 0.4%CVE-2026-23689HIGHDenial of service (DOS) in SAP Supply Chain ManagementEPSS 0.4%CVE-2026-27689HIGHDenial of service (DOS) in SAP Supply Chain ManagementEPSS 0.4%CVE-2026-20301HIGHCisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service VulnerabilityEPSS 0.3%CVE-2026-55731MEDIUMLoytec LINX firmware: Unchecked input for loop condition in the SNMP agentEPSS 0.3%CVE-2025-42930MEDIUMDenial of Service (DoS) vulnerability in SAP Business Planning and ConsolidationEPSS 0.3%CVE-2026-33800HIGHJunos OS: MX Series: In a VC scenario a high rate of micro-BFD session flaps will cause an FPC crashEPSS 0.3%CVE-2026-13761HIGHPega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.EPSS 0.3%CVE-2019-25624MEDIUMLiquid Studio 2.17 Denial of Service via Malformed InputEPSS 0.2%