Falhas do tipo CWE-835

424 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2026-6985MEDIUMCesanta Mongoose TCP Option net_builtin.c handle_opt infinite loopEPSS 0.6%CVE-2023-25653HIGHImproper calculations in ECC implementation can trigger a Denial-of-Service (DoS)EPSS 0.6%CVE-2026-84997HIGHreact/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPUEPSS 0.5%CVE-2025-0673HIGHLoop with Unreachable Exit Condition ('Infinite Loop') in GitLabEPSS 0.5%CVE-2026-4598HIGHVersions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInEPSS 0.5%CVE-2024-0211HIGHLoop with Unreachable Exit Condition ('Infinite Loop') in WiresharkEPSS 0.5%CVE-2026-59879HIGHImmutable.js `List` 32-bit trie overflow → unrecoverable DoSEPSS 0.5%CVE-2026-78250MEDIUMbytebot-ai bytebot Agent Execution Workflow infinite loopEPSS 0.5%CVE-2022-29028—A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), TeamcentEPSS 0.5%CVE-2023-43761HIGHCertain WithSecure products allow Denial of Service (infinite loop). This affects WithSecure Client Security 15, WithSecure Server Security EPSS 0.5%CVE-2025-2962HIGHInfinite loop in dns_copy_qnameEPSS 0.5%CVE-2026-62642MEDIUMIn Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of EPSS 0.5%CVE-2024-36732HIGHAn issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when an empty array is processed with oneflow.teEPSS 0.5%CVE-2025-30145HIGHGeoServer has an Infinite Loop Vulnerability in Jiffle processEPSS 0.5%CVE-2024-43366HIGHzkvyper ignored loop range boundsEPSS 0.5%CVE-2026-64834HIGHFFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF DemuxerEPSS 0.5%CVE-2024-56703HIGHipv6: Fix soft lockups in fib6_select_path under high next hop churnEPSS 0.5%CVE-2026-2739MEDIUMThis affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString()EPSS 0.5%CVE-2024-11941HIGHDrupal core - Moderately critical - Denial of Service - SA-CORE-2024-001EPSS 0.5%CVE-2026-56852HIGHInfinite loop on invalid input in golang.org/x/textEPSS 0.5%