Falhas do tipo CWE-835

534 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2026-78129MEDIUMstrongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.EPSS 0.5%CVE-2023-4511MEDIUMLoop with Unreachable Exit Condition ('Infinite Loop') in WiresharkEPSS 0.5%CVE-2026-59933HIGHPhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustionEPSS 0.5%CVE-2026-11932MEDIUMSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.5%CVE-2026-59901HIGHNetty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread HangEPSS 0.5%CVE-2021-3416—A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issEPSS 0.5%CVE-2026-84446HIGHlibheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_framesEPSS 0.5%CVE-2019-3819MEDIUMA flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite looEPSS 0.5%CVE-2026-93690HIGHuri-js through 4.4.1 Denial of Service via removeDotSegmentsEPSS 0.5%CVE-2026-116581HIGHSeroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)EPSS 0.5%CVE-2026-55865HIGHPython Liquid: Infinite loop when parsing malformed `{% case %}` tagsEPSS 0.5%CVE-2025-7054HIGHInfinite loop triggered by connection ID retirementEPSS 0.4%CVE-2026-122054MEDIUMBIG-HKSCS decoding hang on crafted inputEPSS 0.4%CVE-2025-42954LOWDenial of service (DOS) in SAP NetWeaver Business Warehouse (CCAW application)EPSS 0.4%CVE-2026-24688MEDIUMpypdf has possible Infinite Loop when processing outlines/bookmarksEPSS 0.4%CVE-2024-22654HIGHtcpreplay v4.4.4 was discovered to contain an infinite loop via the tcprewrite function at get.c.EPSS 0.4%CVE-2024-25710HIGHApache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP fileEPSS 0.4%CVE-2026-6554HIGHinfinte loop in libpcap before 1.10.7EPSS 0.4%CVE-2021-3468—A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socEPSS 0.4%CVE-2026-59849LOWLibssh: libssh: denial of service via automatic certificate authentication loopEPSS 0.4%