Falhas do tipo CWE-834
36 resultadosIteração excessiva
Ocorre quando um código realiza loops ou recursões sem limite adequado de iterações, permitindo que um atacante force consumo excessivo de CPU ou memória. O programa não valida ou restringe o número de vezes que um processo é repetido, criando condição para negação de serviço.
Exemplo
Um parser que processa um arquivo JSON com arrays aninhados infinitamente, ou um loop que não tem condição de saída clara baseada em entrada do usuário — ambos podem ser explorados para travar a aplicação ao forçar bilhões de iterações.
Como mitigar
Implemente limites explícitos em loops (máximo de iterações, profundidade de recursão, tamanho de entrada) e valide dados de entrada antes de processar. Use timeouts e monitore consumo de recursos durante execução.
CVE-2021-35515—Apache Commons Compress 1.6 to 1.20 denial of service vulnerabilityEPSS 11.6%CVE-2023-1993MEDIUMLISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture fEPSS 4.1%CVE-2021-31812—A carefully crafted PDF file can trigger an infinite loop while loading the fileEPSS 3.1%CVE-2021-27807—A carefully crafted PDF file can trigger an infinite loop while loading the fileEPSS 3.0%CVE-2019-3565—Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown EPSS 2.8%CVE-2019-3558—Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious cliEPSS 2.0%CVE-2019-3559—Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clienEPSS 2.0%CVE-2019-3564—Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clientsEPSS 2.0%CVE-2019-3552—C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malEPSS 2.0%CVE-2021-39204HIGHExcessive CPU usage in PomeriumEPSS 1.7%CVE-2023-26513HIGHApache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoSEPSS 1.5%CVE-2018-20805MEDIUMInvariant with $elemMatchEPSS 1.2%CVE-2021-32778MEDIUMExcessive CPU utilization when closing HTTP/2 streamsEPSS 1.2%CVE-2024-4603MEDIUMExcessive time spent checking DSA keys and parametersEPSS 1.1%CVE-2023-0411MEDIUMExcessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or EPSS 0.9%CVE-2023-4043MEDIUMParsson DoS when parsing numbers from untrusted sourcesEPSS 0.8%CVE-2024-4227HIGHgSOAP: Vulnerable to specially crafted unencrypted SDC messagesEPSS 0.7%CVE-2023-5632HIGHUnconditionally adding an event to the epoll causes excessive CPU consumptionEPSS 0.7%CVE-2026-64641HIGHNext.js: Denial of Service in App Router using Server ActionsEPSS 0.6%CVE-2025-67726HIGHTornado is Vulnerable to Quadratic DoS via Crafted Multipart ParametersEPSS 0.5%