Falhas do tipo CWE-835

424 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2024-32886MEDIUMVitess vulnerable to infinite memory consumption and vtgate crashEPSS 0.8%CVE-2025-53015HIGHImageMagick has XMP profile write that triggers hang due to unbounded loopEPSS 0.7%CVE-2025-32947HIGHPeerTube ActivityPub Crawl Infinite Loop DoSEPSS 0.7%CVE-2023-2593MEDIUMKernel: ksmbd memory exhaustion denial-of-service vulnerabilityEPSS 0.7%CVE-2025-71319HIGHimage-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF ParserEPSS 0.7%CVE-2022-34661MEDIUMA vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), TeamcenteEPSS 0.7%CVE-2023-24808MEDIUMDenial Of Service when opening a corrupt PDF file in pdfioEPSS 0.7%CVE-2024-10829HIGHDenial of Service (DoS) via Multipart Boundary in eosphoros-ai/db-gptEPSS 0.7%CVE-2026-11352HIGHQUIC zero-length UDP datagrams busy-loopEPSS 0.7%CVE-2024-27359HIGHCertain WithSecure products allow a Denial of Service because the engine scanner can go into an infinite loop when processing an archive filEPSS 0.7%CVE-2023-20083HIGHA vulnerability in ICMPv6 inspection when configured with the Snort 2 detection engine for Cisco Firepower Threat Defense (FTD) Software couEPSS 0.7%CVE-2026-4111HIGHLibarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchiveEPSS 0.7%CVE-2022-48256HIGHTechnitium DNS Server before 10.0 allows a self-CNAME denial-of-service attack in which a CNAME loop causes an answer to contain hundreds ofEPSS 0.7%CVE-2024-36990MEDIUMDenial of Service (DoS) on the datamodel/web REST endpointEPSS 0.7%CVE-2024-10907HIGHDenial of Service (DoS) via Multipart Boundary in lm-sys/fastchatEPSS 0.7%CVE-2025-20217HIGHCisco Firepower Threat Defense Intrusion Detection Denial of Service VulnerabilityEPSS 0.7%CVE-2023-20200HIGHA vulnerability in the Simple Network Management Protocol (SNMP) service of Cisco FXOS Software for Firepower 4100 Series and Firepower 9300EPSS 0.7%CVE-2022-4345MEDIUMInfinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service EPSS 0.7%CVE-2024-34487HIGHOFPFlowStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via inst.length=0.EPSS 0.7%CVE-2024-34489HIGHOFPHello in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via length=0.EPSS 0.7%