Falhas do tipo CWE-835

424 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2024-34489HIGHOFPHello in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via length=0.EPSS 0.7%CVE-2024-32976HIGHEnvoy can enter an endless loop while decompressing Brotli data with extra inputEPSS 0.7%CVE-2026-54904HIGHconcurrent-ruby: `AtomicReference#update` livelocks when the stored value is `Float::NAN`EPSS 0.7%CVE-2023-42814LOWDenial of service from malicious image manifest in kyvernoEPSS 0.7%CVE-2023-42815LOWDenial of service from malicious image manifest in kyvernoEPSS 0.7%CVE-2024-55565MEDIUMnanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.EPSS 0.7%CVE-2026-59203MEDIUMPillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of serviceEPSS 0.7%CVE-2023-51075HIGHhutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. This vulnerability allows attackersEPSS 0.7%CVE-2024-40060HIGHgo-chart v2.1.1 was discovered to contain an infinite loop via the drawCanvas() function.EPSS 0.6%CVE-2023-5825MEDIUMLoop with Unreachable Exit Condition ('Infinite Loop') in GitLabEPSS 0.6%CVE-2025-8194HIGHTarfile infinite loop during parsing with negative member offsetEPSS 0.6%CVE-2026-39806HIGHHTTP/1 chunked decoder infinite loop on requests with trailer fields in banditEPSS 0.6%CVE-2026-34282HIGHVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: NetworkEPSS 0.6%CVE-2026-81876HIGHHAPI FHIR: SHCParser DEFLATE infinite loop causes denial of serviceEPSS 0.6%CVE-2026-82560HIGHPod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output widthEPSS 0.6%CVE-2024-10821HIGHDenial of Service (DoS) in invoke-ai/invokeaiEPSS 0.6%CVE-2024-45692HIGHWebmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.EPSS 0.6%CVE-2026-46385HIGHiskorotkov/avro: CPU Exhaustion in Avro DecoderEPSS 0.6%CVE-2026-59935HIGHpypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)EPSS 0.6%CVE-2022-39052HIGHDoS attack using emailEPSS 0.6%