Falhas do tipo CWE-835

532 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2021-34334MEDIUMDenial of service due to integer overflow in loop counterEPSS 1.1%CVE-2021-34332—A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll libEPSS 1.1%CVE-2021-37621MEDIUMDenial of service due to infinite loop in Image::printIFDStructureEPSS 1.1%CVE-2021-37622MEDIUMDenial of service due to infinite loop in JpegBase::printStructure (#1)EPSS 1.1%CVE-2023-0437MEDIUMMongoDB client C Driver may infinitely loop when validating certain BSON input dataEPSS 1.1%CVE-2023-2952MEDIUMXRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted captureEPSS 1.1%CVE-2024-30251HIGHDenial of service when trying to parse malformed POST requests in aiohttpEPSS 1.1%CVE-2023-25824HIGHmod_gnutls contains Infinite Loop on request read timeoutEPSS 1.1%CVE-2021-37623MEDIUMDenial of service due to infinite loop in JpegBase::printStructure (#2)EPSS 1.1%CVE-2026-92387HIGHnever-ending loop via server response omissionEPSS 1.0%CVE-2026-43871HIGHApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limitEPSS 1.0%CVE-2026-11352HIGHQUIC zero-length UDP datagrams busy-loopEPSS 1.0%CVE-2021-0273MEDIUMJunos OS and Junos OS Evolved: Trio Chipset: Denial of Service due to packet destined to device's interfaces.EPSS 1.0%CVE-2024-24788MEDIUMMalformed DNS message can cause infinite loop in netEPSS 1.0%CVE-2023-23617MEDIUMOpenMage LTS has DoS vulnerability in MaliciousCode filterEPSS 1.0%CVE-2021-21279HIGHInfinite loop in IPv6 neighbor solicitation processingEPSS 1.0%CVE-2021-29510LOWUse of "infinity" as an input to datetime and date fields causes infinite loop in pydanticEPSS 1.0%CVE-2024-9340HIGHDenial of Service (DoS) via Multipart Boundary in zenml-io/zenmlEPSS 1.0%CVE-2023-22325MEDIUMA denial of service vulnerability exists in the DCRegister DDNS_RPC_MAX_RECV_SIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 aEPSS 1.0%CVE-2024-32650HIGHRustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client inputEPSS 0.9%