Fallos del tipo CWE-835

425 resultados

Loop infinito com condição de saída inalcançável

A aplicação entra em um loop (iteração) cuja condição de parada nunca é verdadeira ou nunca é checada, trancando a execução indefinidamente. Isso causa travamento, consumo excessivo de CPU, negação de serviço ou congelamento de funcionalidades críticas.

Ejemplo

Um servidor web com while(true) lendo dados de rede, mas a condição de encerramento da conexão nunca é avaliada corretamente; ou um aplicativo mobile em loop aguardando uma resposta de API que nunca chega, sem timeout definido.

Cómo mitigar

Sempre defina condições de saída claras e alcançáveis (break, return, exceção); implemente timeouts em operações de I/O e loops que dependem de eventos externos; use ferramentas de análise estática para detectar loops sem saída óbvia; considere usar watchdogs ou sinais de interrupção como fallback.

CVE-2017-16932HIGHparser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.EPSS 5.9%CVE-2021-39140MEDIUMXStream can cause a Denial of ServiceEPSS 5.9%CVE-2021-41973—Apache MINA HTTP listener DOSEPSS 4.6%CVE-2024-21408MEDIUMWindows Hyper-V Denial of Service VulnerabilityEPSS 4.5%CVE-2019-3900MEDIUMAn infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packetEPSS 4.3%CVE-2020-5761—Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to CPU exhaustion due to an infinite loop in the TR-069 service. EPSS 4.1%CVE-2017-2670HIGHIt was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effecEPSS 3.7%CVE-2021-20270—An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a StandaEPSS 2.8%CVE-2021-28657—Infinite loop in Apache Tika's MP3 parserEPSS 2.8%CVE-2011-1142HIGHStack consumption vulnerability in the dissect_ber_choice function in the BER dissector in Wireshark 1.2.x through 1.2.15 and 1.4.x through EPSS 2.6%CVE-2024-1931HIGHDenial of service when trimming EDE text on positive repliesEPSS 2.5%CVE-2026-42899HIGHASP.NET Core Denial of Service VulnerabilityEPSS 2.4%CVE-2019-3560—An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denial-of-service based onEPSS 2.4%CVE-2018-14621MEDIUMAn infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than select, exhaustion ofEPSS 2.3%CVE-2017-9023HIGHThe ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allows remote attackers tEPSS 2.2%CVE-2026-33116HIGH.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityEPSS 2.1%CVE-2022-24763HIGHInfinite Loop in PJSIPEPSS 2.1%CVE-2024-43512MEDIUMWindows Standards-Based Storage Management Service Denial of Service VulnerabilityEPSS 2.1%CVE-2023-45233HIGHInfinite loop in EDK II Network PackageEPSS 2.1%CVE-2023-45232HIGHInfinite loop in EDK II Network PackageEPSS 2.1%