Falhas do tipo CWE-835

424 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2023-51890HIGHAn infinite loop issue discovered in Mathtex 1.05 and before allows a remote attackers to consume CPU resources via crafted string in the apEPSS 0.9%CVE-2026-50324MEDIUMWindows Active Directory Federation Services Denial of Service VulnerabilityEPSS 0.9%CVE-2026-54772HIGHCoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshakeEPSS 0.8%CVE-2022-1222MEDIUMInf loop in gpac/gpacEPSS 0.8%CVE-2023-33305MEDIUMA loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.EPSS 0.8%CVE-2024-28732HIGHAn issue was discovered in OFPMatch in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) EPSS 0.8%CVE-2023-40458HIGHAceManager DOS VulnerabilityEPSS 0.8%CVE-2023-27560HIGHMath/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with composite primefields.EPSS 0.8%CVE-2024-12704HIGHDenial of Service (DoS) in run-llama/llama_indexEPSS 0.8%CVE-2021-42143CRITICALAn issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. An infinite loop bug exists during the handling of a ClientHelEPSS 0.8%CVE-2024-4854MEDIUMLoop with Unreachable Exit Condition ('Infinite Loop') in WiresharkEPSS 0.8%CVE-2026-30922HIGHpyasn1 Vulnerable to Denial of Service via Unbounded RecursionEPSS 0.8%CVE-2023-3748LOWInifinite loop in babld message parsing may cause dosEPSS 0.8%CVE-2024-29904HIGHCodeIgniter4 Language class DoS VulnerabilityEPSS 0.8%CVE-2023-50981HIGHModularSquareRoot in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (infinite loop) via crafted DER pubEPSS 0.8%CVE-2022-34760HIGHA CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability exists that could cause a denial of service of the webserverEPSS 0.8%CVE-2021-3508—A flaw was found in PDFResurrect in version 0.22b. There is an infinite loop in get_xref_linear_skipped() in pdf.c via a crafted PDF file.EPSS 0.8%CVE-2024-53980MEDIUMSpoofed length byte traps CC2538 in endless loopEPSS 0.8%CVE-2026-47066HIGHInfinite loop in Alt-Svc header parser in hackneyEPSS 0.8%CVE-2023-43645MEDIUMDenial of service from circular relationship definitions in OpenFGAEPSS 0.8%