Falhas do tipo CWE-835

532 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2022-29028—A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), TeamcentEPSS 0.5%CVE-2024-0211HIGHLoop with Unreachable Exit Condition ('Infinite Loop') in WiresharkEPSS 0.5%CVE-2026-55588MEDIUMORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource ConsumptionEPSS 0.5%CVE-2025-30145HIGHGeoServer has an Infinite Loop Vulnerability in Jiffle processEPSS 0.5%CVE-2026-68096HIGHaudit: fix recursive locking deadlock in audit_dupe_exe()EPSS 0.5%CVE-2026-106121MEDIUMRabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoSEPSS 0.5%CVE-2026-2739MEDIUMThis affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString()EPSS 0.5%CVE-2026-20019MEDIUMMultiple Cisco Products Snort 3 Netflow Denial of Service VulnerabilitiesEPSS 0.5%CVE-2026-76445MEDIUMMultiple Cisco Products Snort 3 Denial of Service VulnerabilityEPSS 0.5%CVE-2025-10903MEDIUMLoop with Unreachable Exit Condition ('Infinite Loop') in GitLabEPSS 0.5%CVE-2026-61556HIGHLiquidJS: An infinite loop vulnerability in `strip_html` filterEPSS 0.5%CVE-2025-53628MEDIUMcpp-httplib does not limit the length of a lineEPSS 0.5%CVE-2026-85730HIGHsmol-toml: Denial of Service via malformed TOML documentsEPSS 0.5%CVE-2026-107602HIGHKeycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loopEPSS 0.5%CVE-2026-115774MEDIUMTwisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCHEPSS 0.5%CVE-2024-36732HIGHAn issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when an empty array is processed with oneflow.teEPSS 0.5%CVE-2025-20253HIGHCisco IOS, IOS XE, Secure Firewall Adaptive Security Appliance, and Secure Firewall Threat Defense Software IKEv2 Denial of Service VulnerabilityEPSS 0.5%CVE-2024-43366HIGHzkvyper ignored loop range boundsEPSS 0.5%CVE-2026-111496CRITICALApache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuationEPSS 0.5%CVE-2026-46052HIGHceph: only d_add() negative dentries when they are unhashedEPSS 0.5%