Falhas do tipo CWE-835

422 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2017-16932HIGHparser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.EPSS 6.0%CVE-2021-39140MEDIUMXStream can cause a Denial of ServiceEPSS 5.9%CVE-2021-41973—Apache MINA HTTP listener DOSEPSS 4.6%CVE-2024-21408MEDIUMWindows Hyper-V Denial of Service VulnerabilityEPSS 4.5%CVE-2019-3900MEDIUMAn infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packetEPSS 4.3%CVE-2020-5761—Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to CPU exhaustion due to an infinite loop in the TR-069 service. EPSS 4.1%CVE-2017-2670HIGHIt was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effecEPSS 3.7%CVE-2021-20270—An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a StandaEPSS 2.8%CVE-2021-28657—Infinite loop in Apache Tika's MP3 parserEPSS 2.8%CVE-2011-1142HIGHStack consumption vulnerability in the dissect_ber_choice function in the BER dissector in Wireshark 1.2.x through 1.2.15 and 1.4.x through EPSS 2.6%CVE-2024-1931HIGHDenial of service when trimming EDE text on positive repliesEPSS 2.5%CVE-2026-42899HIGHASP.NET Core Denial of Service VulnerabilityEPSS 2.4%CVE-2019-3560—An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denial-of-service based onEPSS 2.4%CVE-2017-9023HIGHThe ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allows remote attackers tEPSS 2.2%CVE-2018-14621MEDIUMAn infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than select, exhaustion ofEPSS 2.1%CVE-2026-33116HIGH.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityEPSS 2.1%CVE-2022-24763HIGHInfinite Loop in PJSIPEPSS 2.1%CVE-2024-43512MEDIUMWindows Standards-Based Storage Management Service Denial of Service VulnerabilityEPSS 2.1%CVE-2023-45232HIGHInfinite loop in EDK II Network PackageEPSS 2.1%CVE-2023-45233HIGHInfinite loop in EDK II Network PackageEPSS 2.1%