Falhas do tipo CWE-835

424 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2026-27628LOWpypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streamsEPSS 0.3%CVE-2026-91952HIGHFreeRDP before 3.31.0 Denial of Service via pool_decode_rectEPSS 0.3%CVE-2024-23352HIGHLoop with Unreachable Exit Condition (`Infinite Loop`) in Multi Mode Call ProcessorEPSS 0.3%CVE-2026-64611HIGHLibcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()EPSS 0.3%CVE-2026-10686MEDIUMMissing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routersEPSS 0.3%CVE-2026-54623HIGHdjango CMS: Plugin move endpoint allows cyclic reparenting (DoS)EPSS 0.3%CVE-2026-41680HIGHMarked: OOM Denial of Service via Infinite Recursion in marked TokenizerEPSS 0.3%CVE-2026-68537HIGHFulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of serviceEPSS 0.3%CVE-2026-68523HIGHFulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of serviceEPSS 0.3%CVE-2025-51986HIGHAn issue was discovered in the demo/LINUXTCP implementation of cwalter-at freemodbus v.2018-09-12 allowing attackers to reach an infinite loEPSS 0.3%CVE-2026-54886MEDIUMSSH SFTP server denial of service via extended channel data infinite loopEPSS 0.3%CVE-2026-88000MEDIUMOpen WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat treeEPSS 0.3%CVE-2026-82605MEDIUMBareBones BBEdit Lasso Language Tokenizer infinite loopEPSS 0.3%CVE-2026-67214HIGHnanoid Infinite Loop via Negative Size in non-secure moduleEPSS 0.3%CVE-2026-8798HIGHNative entropy source retries the CPU entropy instructions without limitEPSS 0.3%CVE-2026-26066MEDIUMImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profileEPSS 0.3%CVE-2026-26283MEDIUMImageMagick has possible infinite loop in JPEG encoder when using `jpeg:extent`EPSS 0.3%CVE-2026-88002MEDIUMOpen WebUI: Any authenticated user can hang the server via a cyclic chat message historyEPSS 0.3%CVE-2026-31808MEDIUMfile-type affected by infinite loop in ASF parser on malformed input with zero-size sub-headerEPSS 0.3%CVE-2023-43511HIGHLoop with Unreachable Exit Condition (Infinite Loop) in WLAN FirmwareEPSS 0.3%