Falhas do tipo CWE-835

424 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2021-29486HIGHImproper Input Validation and Loop with Unreachable Exit Condition ('Infinite Loop') in cumulative-distribution-functionEPSS 2.0%CVE-2019-5091HIGHAn exploitable denial-of-service vulnerability exists in the Dicom-packet parsing functionality of LEADTOOLS libltdic.so version 20.0.2019.3EPSS 1.9%CVE-2022-24792HIGH Potential infinite loop when parsing WAV format file in PJSIPEPSS 1.9%CVE-2023-3255MEDIUMQemu: vnc: infinite loop in inflate_buffer() leads to denial of serviceEPSS 1.9%CVE-2021-25664HIGHA vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions EPSS 1.9%CVE-2021-25663HIGHA vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions EPSS 1.9%CVE-2017-2646HIGHIt was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParEPSS 1.9%CVE-2026-46522HIGHImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustionEPSS 1.8%CVE-2022-21159HIGHA denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec61850 1.5.0. A speciallyEPSS 1.8%CVE-2016-9581LOWAn infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2.EPSS 1.8%CVE-2024-11612MEDIUM7-Zip CopyCoder Infinite Loop Denial-of-Service VulnerabilityEPSS 1.8%CVE-2023-1108HIGHUndertow: infinite loop in sslconduit during closeEPSS 1.8%CVE-2022-29190HIGHHeader reconstruction method can be thrown into an infinite loop in Pion DTLSEPSS 1.7%CVE-2021-39194MEDIUMDenial of service while parsing polymorphic input with tagged polymorphism style in kamlEPSS 1.7%CVE-2022-23596HIGHInfinite loop in junrarEPSS 1.6%CVE-2023-2879MEDIUMGDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture fileEPSS 1.6%CVE-2024-24746HIGHApache NimBLE: Denial of service in NimBLE Bluetooth stackEPSS 1.4%CVE-2018-20803MEDIUMInfinite loop in aggregation expressionEPSS 1.4%CVE-2021-29482HIGHdenial of service in github.com/ulikunitz/xzEPSS 1.4%CVE-2022-24859MEDIUMManipulated inline images can cause Infinite Loop in PyPDF2EPSS 1.3%