Fallos del tipo CWE-835

532 resultados

Loop infinito com condição de saída inalcançável

A aplicação entra em um loop (iteração) cuja condição de parada nunca é verdadeira ou nunca é checada, trancando a execução indefinidamente. Isso causa travamento, consumo excessivo de CPU, negação de serviço ou congelamento de funcionalidades críticas.

Ejemplo

Um servidor web com while(true) lendo dados de rede, mas a condição de encerramento da conexão nunca é avaliada corretamente; ou um aplicativo mobile em loop aguardando uma resposta de API que nunca chega, sem timeout definido.

Cómo mitigar

Sempre defina condições de saída claras e alcançáveis (break, return, exceção); implemente timeouts em operações de I/O e loops que dependem de eventos externos; use ferramentas de análise estática para detectar loops sem saída óbvia; considere usar watchdogs ou sinais de interrupção como fallback.

CVE-2026-4111HIGHLibarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchiveEPSS 0.7%CVE-2023-24808MEDIUMDenial Of Service when opening a corrupt PDF file in pdfioEPSS 0.7%CVE-2023-20116MEDIUMA vulnerability in the Administrative XML Web Service (AXL) API of Cisco Unified Communications Manager (Unified CM) and Cisco Unified CommuEPSS 0.7%CVE-2022-48256HIGHTechnitium DNS Server before 10.0 allows a self-CNAME denial-of-service attack in which a CNAME loop causes an answer to contain hundreds ofEPSS 0.7%CVE-2024-27359HIGHCertain WithSecure products allow a Denial of Service because the engine scanner can go into an infinite loop when processing an archive filEPSS 0.7%CVE-2024-10907HIGHDenial of Service (DoS) via Multipart Boundary in lm-sys/fastchatEPSS 0.7%CVE-2022-4345MEDIUMInfinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service EPSS 0.7%CVE-2021-3508—A flaw was found in PDFResurrect in version 0.22b. There is an infinite loop in get_xref_linear_skipped() in pdf.c via a crafted PDF file.EPSS 0.7%CVE-2024-34487HIGHOFPFlowStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via inst.length=0.EPSS 0.7%CVE-2024-36990MEDIUMDenial of Service (DoS) on the datamodel/web REST endpointEPSS 0.7%CVE-2026-103492MEDIUMIn JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachmentsEPSS 0.7%CVE-2023-20200HIGHA vulnerability in the Simple Network Management Protocol (SNMP) service of Cisco FXOS Software for Firepower 4100 Series and Firepower 9300EPSS 0.7%CVE-2024-34488HIGHOFPMultipartReply in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via b.length=0.EPSS 0.7%CVE-2024-34489HIGHOFPHello in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via length=0.EPSS 0.7%CVE-2024-32976HIGHEnvoy can enter an endless loop while decompressing Brotli data with extra inputEPSS 0.7%CVE-2026-54904HIGHconcurrent-ruby: `AtomicReference#update` livelocks when the stored value is `Float::NAN`EPSS 0.7%CVE-2026-54538HIGHxrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADEREPSS 0.7%CVE-2023-42814LOWDenial of service from malicious image manifest in kyvernoEPSS 0.7%CVE-2023-42815LOWDenial of service from malicious image manifest in kyvernoEPSS 0.7%CVE-2024-55565MEDIUMnanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.EPSS 0.7%