Fallos del tipo CWE-835

424 resultados

Loop infinito com condição de saída inalcançável

A aplicação entra em um loop (iteração) cuja condição de parada nunca é verdadeira ou nunca é checada, trancando a execução indefinidamente. Isso causa travamento, consumo excessivo de CPU, negação de serviço ou congelamento de funcionalidades críticas.

Ejemplo

Um servidor web com while(true) lendo dados de rede, mas a condição de encerramento da conexão nunca é avaliada corretamente; ou um aplicativo mobile em loop aguardando uma resposta de API que nunca chega, sem timeout definido.

Cómo mitigar

Sempre defina condições de saída claras e alcançáveis (break, return, exceção); implemente timeouts em operações de I/O e loops que dependem de eventos externos; use ferramentas de análise estática para detectar loops sem saída óbvia; considere usar watchdogs ou sinais de interrupção como fallback.

CVE-2021-37621MEDIUMDenial of service due to infinite loop in Image::printIFDStructureEPSS 1.1%CVE-2023-0437MEDIUMMongoDB client C Driver may infinitely loop when validating certain BSON input dataEPSS 1.1%CVE-2023-2952MEDIUMXRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted captureEPSS 1.1%CVE-2024-30251HIGHDenial of service when trying to parse malformed POST requests in aiohttpEPSS 1.1%CVE-2023-25824HIGHmod_gnutls contains Infinite Loop on request read timeoutEPSS 1.1%CVE-2025-68137HIGHEVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loopEPSS 1.1%CVE-2021-37623MEDIUMDenial of service due to infinite loop in JpegBase::printStructure (#2)EPSS 1.1%CVE-2021-0273MEDIUMJunos OS and Junos OS Evolved: Trio Chipset: Denial of Service due to packet destined to device's interfaces.EPSS 1.0%CVE-2024-24788MEDIUMMalformed DNS message can cause infinite loop in netEPSS 1.0%CVE-2023-23617MEDIUMOpenMage LTS has DoS vulnerability in MaliciousCode filterEPSS 1.0%CVE-2021-21279HIGHInfinite loop in IPv6 neighbor solicitation processingEPSS 1.0%CVE-2021-29510LOWUse of "infinity" as an input to datetime and date fields causes infinite loop in pydanticEPSS 1.0%CVE-2023-22325MEDIUMA denial of service vulnerability exists in the DCRegister DDNS_RPC_MAX_RECV_SIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 aEPSS 1.0%CVE-2024-9340HIGHDenial of Service (DoS) via Multipart Boundary in zenml-io/zenmlEPSS 1.0%CVE-2024-32650HIGHRustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client inputEPSS 0.9%CVE-2024-52532HIGHGNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clienEPSS 0.9%CVE-2026-55199HIGHlibssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO HandlerEPSS 0.9%CVE-2020-27618MEDIUMThe iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364EPSS 0.9%CVE-2023-47997MEDIUMAn issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 leads to an infinite loop and allows attackers to causEPSS 0.9%CVE-2023-20020HIGHA vulnerability in the Device Management Servlet application of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended EPSS 0.9%