Falhas do tipo CWE-835

532 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2021-29482HIGHdenial of service in github.com/ulikunitz/xzEPSS 1.4%CVE-2022-24859MEDIUMManipulated inline images can cause Infinite Loop in PyPDF2EPSS 1.3%CVE-2018-10912MEDIUMkeycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could miEPSS 1.3%CVE-2025-68137HIGHEVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loopEPSS 1.3%CVE-2023-38197HIGHAn issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursiveEPSS 1.3%CVE-2022-46285HIGHA flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition will not be detected,EPSS 1.3%CVE-2022-34862HIGHTMM vulnerability CVE-2022-34862EPSS 1.3%CVE-2024-8088HIGHInfinite loop when iterating over zip archive entry names from zipfile.PathEPSS 1.3%CVE-2023-6245HIGHInfinite decoding loop through specially crafted payloadEPSS 1.2%CVE-2024-45506HIGHHAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwardinEPSS 1.2%CVE-2026-50647HIGHActive Directory Federation Server Denial of Service VulnerabilityEPSS 1.2%CVE-2026-50653HIGHAzure Active Directory Denial of Service VulnerabilityEPSS 1.2%CVE-2026-54119HIGHWindows Active Directory Denial of Service VulnerabilityEPSS 1.2%CVE-2023-20197HIGHA vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attEPSS 1.2%CVE-2024-50321HIGHAn infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.EPSS 1.2%CVE-2024-50319HIGHAn infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.EPSS 1.2%CVE-2022-23641MEDIUMDenial of Service in DiscourseEPSS 1.2%CVE-2022-37013HIGHThis vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C+EPSS 1.2%CVE-2026-28214MEDIUMFirebird server hangs when using specific clumplet on batch creationEPSS 1.1%CVE-2023-35933MEDIUMOpenFGA denial of service die to circular relationshipEPSS 1.1%