Falhas do tipo CWE-835

425 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2025-2838MEDIUMSilicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service VulnerabilityEPSS 0.3%CVE-2025-48879MEDIUMOctoPrint Vulnerable to Denial of Service through malformed HTTP requestEPSS 0.3%CVE-2026-61633LOWNanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoSEPSS 0.3%CVE-2023-50120MEDIUMMP4Box GPAC version 2.3-DEV-rev636-gfbd7e13aa-master was discovered to contain an infinite loop in the function av1_uvlc at media_tools/av_pEPSS 0.3%CVE-2026-59849LOWLibssh: libssh: denial of service via automatic certificate authentication loopEPSS 0.2%CVE-2026-10642MEDIUMUnbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow controlEPSS 0.2%CVE-2023-46250MEDIUMpypdf possible Infinite Loop when PdfWriter(clone_from) is used with a PDFEPSS 0.2%CVE-2026-25533MEDIUMEnclave has a sandbox escape via infinite recursion and error objectsEPSS 0.2%CVE-2024-5569MEDIUMDenial of Service via crafted zip file in jaraco/zippEPSS 0.2%CVE-2025-32029MEDIUMts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value RepresentationEPSS 0.2%CVE-2022-48635MEDIUMfsdax: Fix infinite loop in dax_iomap_rw()EPSS 0.2%CVE-2026-47863MEDIUMReactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flushEPSS 0.2%CVE-2022-49317MEDIUMf2fs: avoid infinite loop to flush node pagesEPSS 0.2%CVE-2021-25673—A vulnerability has been identified in SIMATIC S7-PLCSIM V5.4 (All versions). An attacker with local access to the system could cause a DeniEPSS 0.2%CVE-2021-33642MEDIUMWhen a file is processed, an infinite loop occurs in next_inline() of the more_curly() function.EPSS 0.2%CVE-2015-10103LOWInternalError503 Forget It settings.js infinite loopEPSS 0.2%CVE-2026-10683LOWDesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS)EPSS 0.2%CVE-2025-21667MEDIUMiomap: avoid avoid truncating 64-bit offset to 32 bitsEPSS 0.2%CVE-2026-32777MEDIUMlibexpat before 2.7.5 allows an infinite loop while parsing DTD content.EPSS 0.2%CVE-2025-21665MEDIUMfilemap: avoid truncating 64-bit offset to 32 bitsEPSS 0.2%