Falhas do tipo CWE-835

424 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2018-10912MEDIUMkeycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could miEPSS 1.3%CVE-2023-38197HIGHAn issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursiveEPSS 1.3%CVE-2024-8088HIGHInfinite loop when iterating over zip archive entry names from zipfile.PathEPSS 1.3%CVE-2022-46285HIGHA flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition will not be detected,EPSS 1.3%CVE-2022-34862HIGHTMM vulnerability CVE-2022-34862EPSS 1.3%CVE-2023-6245HIGHInfinite decoding loop through specially crafted payloadEPSS 1.2%CVE-2024-45506HIGHHAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwardinEPSS 1.2%CVE-2026-54119HIGHWindows Active Directory Denial of Service VulnerabilityEPSS 1.2%CVE-2026-50653HIGHAzure Active Directory Denial of Service VulnerabilityEPSS 1.2%CVE-2026-50647HIGHActive Directory Federation Server Denial of Service VulnerabilityEPSS 1.2%CVE-2023-20197HIGHA vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attEPSS 1.2%CVE-2024-50321HIGHAn infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.EPSS 1.2%CVE-2024-50319HIGHAn infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.EPSS 1.2%CVE-2022-23641MEDIUMDenial of Service in DiscourseEPSS 1.2%CVE-2022-37013HIGHThis vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C+EPSS 1.2%CVE-2026-28214MEDIUMFirebird server hangs when using specific clumplet on batch creationEPSS 1.1%CVE-2023-35933MEDIUMOpenFGA denial of service die to circular relationshipEPSS 1.1%CVE-2021-34334MEDIUMDenial of service due to integer overflow in loop counterEPSS 1.1%CVE-2021-34332—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll libEPSS 1.1%CVE-2021-37622MEDIUMDenial of service due to infinite loop in JpegBase::printStructure (#1)EPSS 1.1%