Falhas do tipo CWE-835

424 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2021-37621MEDIUMDenial of service due to infinite loop in Image::printIFDStructureEPSS 1.1%CVE-2023-0437MEDIUMMongoDB client C Driver may infinitely loop when validating certain BSON input dataEPSS 1.1%CVE-2023-2952MEDIUMXRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted captureEPSS 1.1%CVE-2024-30251HIGHDenial of service when trying to parse malformed POST requests in aiohttpEPSS 1.1%CVE-2023-25824HIGHmod_gnutls contains Infinite Loop on request read timeoutEPSS 1.1%CVE-2025-68137HIGHEVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loopEPSS 1.1%CVE-2021-37623MEDIUMDenial of service due to infinite loop in JpegBase::printStructure (#2)EPSS 1.1%CVE-2021-0273MEDIUMJunos OS and Junos OS Evolved: Trio Chipset: Denial of Service due to packet destined to device's interfaces.EPSS 1.0%CVE-2024-24788MEDIUMMalformed DNS message can cause infinite loop in netEPSS 1.0%CVE-2023-23617MEDIUMOpenMage LTS has DoS vulnerability in MaliciousCode filterEPSS 1.0%CVE-2021-21279HIGHInfinite loop in IPv6 neighbor solicitation processingEPSS 1.0%CVE-2021-29510LOWUse of "infinity" as an input to datetime and date fields causes infinite loop in pydanticEPSS 1.0%CVE-2023-22325MEDIUMA denial of service vulnerability exists in the DCRegister DDNS_RPC_MAX_RECV_SIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 aEPSS 1.0%CVE-2024-9340HIGHDenial of Service (DoS) via Multipart Boundary in zenml-io/zenmlEPSS 1.0%CVE-2024-32650HIGHRustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client inputEPSS 0.9%CVE-2024-52532HIGHGNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clienEPSS 0.9%CVE-2026-55199HIGHlibssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO HandlerEPSS 0.9%CVE-2020-27618MEDIUMThe iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364EPSS 0.9%CVE-2023-47997MEDIUMAn issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 leads to an infinite loop and allows attackers to causEPSS 0.9%CVE-2023-20020HIGHA vulnerability in the Device Management Servlet application of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended EPSS 0.9%