Falhas do tipo CWE-835

534 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2026-26066MEDIUMImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profileEPSS 0.4%CVE-2026-8318MEDIUMVectifyAI PageIndex PDF Table of Contents page_index.py toc_transformer infinite loopEPSS 0.4%CVE-2021-20257—An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in procEPSS 0.4%CVE-2024-6614MEDIUMIncorrect listing of stack framesEPSS 0.4%CVE-2026-31808MEDIUMfile-type affected by infinite loop in ASF parser on malformed input with zero-size sub-headerEPSS 0.4%CVE-2025-55118HIGHBMC Control-M/Agent memory corruption in SSL/TLS communicationEPSS 0.4%CVE-2026-68762MEDIUMIn JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possibleEPSS 0.4%CVE-2026-41146HIGHfacil.io and downstream iodine ruby gem vulnerable to uncontrolled resource consumption and loop with unreachable exit conditionEPSS 0.4%CVE-2025-51986HIGHAn issue was discovered in the demo/LINUXTCP implementation of cwalter-at freemodbus v.2018-09-12 allowing attackers to reach an infinite loEPSS 0.4%CVE-2026-59877MEDIUMprotobufjs: Denial of Service via infinite loop in .proto option parsingEPSS 0.4%CVE-2026-86537HIGHApache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny serviceEPSS 0.4%CVE-2026-86535HIGHApache Thrift: A JSON member name can stall the Node server's event loop indefinitelyEPSS 0.4%CVE-2026-107696HIGHFFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.cEPSS 0.4%CVE-2026-49017HIGHIn OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request boEPSS 0.4%CVE-2026-77117MEDIUMSHIFT_JISX0213 decoding may hang on crafted inputEPSS 0.4%CVE-2026-80489MEDIUMEUC_JISX0213 decoding may hang on crafted inputEPSS 0.4%CVE-2026-0619MEDIUMInteger Wraparound DoS in Silicon Labs Matter ImplementationEPSS 0.4%CVE-2026-113794MEDIUMpypdf: Possible infinite loop when hitting EOF in standard xref tableEPSS 0.4%CVE-2026-113793MEDIUMpypdf: Possible infinite loop when removing tree itemsEPSS 0.4%CVE-2026-7263MEDIUMDoS attack via DOMNode::C14N()EPSS 0.4%