Falhas do tipo CWE-835

534 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2026-46052HIGHceph: only d_add() negative dentries when they are unhashedEPSS 0.5%CVE-2026-31448CRITICALext4: avoid infinite loops caused by residual dataEPSS 0.5%CVE-2026-72712MEDIUMNmap 7.99 Denial of Service via Zero-Length TCP Option PacketEPSS 0.5%CVE-2024-56703HIGHipv6: Fix soft lockups in fib6_select_path under high next hop churnEPSS 0.5%CVE-2026-96780HIGHfiglet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small widthEPSS 0.5%CVE-2026-32875HIGHUltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loopEPSS 0.5%CVE-2026-20054MEDIUMCisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Infinite Loop Denial of Service VulnerabilityEPSS 0.5%CVE-2026-54623HIGHdjango CMS: Plugin move endpoint allows cyclic reparenting (DoS)EPSS 0.5%CVE-2026-87013MEDIUMOpen WebUI: Any authenticated user can start a non-terminating request via a folder parent cycleEPSS 0.5%CVE-2026-102046HIGHJunos OS: MX Series: An attacker causes a Routing Engine denial of service when SCTP service is usedEPSS 0.5%CVE-2024-11941HIGHDrupal core - Moderately critical - Denial of Service - SA-CORE-2024-001EPSS 0.5%CVE-2026-120194HIGHJson-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice stepEPSS 0.5%CVE-2026-56852HIGHInfinite loop on invalid input in golang.org/x/textEPSS 0.5%CVE-2026-33699MEDIUMpypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_streamEPSS 0.5%CVE-2026-68906HIGHlibIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDUEPSS 0.5%CVE-2022-28886MEDIUMDenial-of-Service (DoS) VulnerabilityEPSS 0.5%CVE-2024-45395LOWUnbounded loop over untrusted input can lead to endless data attackEPSS 0.5%CVE-2026-107695HIGHFFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing PlaylistEPSS 0.5%CVE-2026-82579MEDIUMAshAi tool loop never terminates when all tool calls are filtered out, enabling denial of serviceEPSS 0.5%CVE-2026-2219HIGHIt was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data sEPSS 0.5%