Falhas do tipo CWE-835

517 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2023-24808MEDIUMDenial Of Service when opening a corrupt PDF file in pdfioEPSS 0.7%CVE-2025-20217HIGHCisco Firepower Threat Defense Intrusion Detection Denial of Service VulnerabilityEPSS 0.7%CVE-2023-20116MEDIUMA vulnerability in the Administrative XML Web Service (AXL) API of Cisco Unified Communications Manager (Unified CM) and Cisco Unified CommuEPSS 0.7%CVE-2022-48256HIGHTechnitium DNS Server before 10.0 allows a self-CNAME denial-of-service attack in which a CNAME loop causes an answer to contain hundreds ofEPSS 0.7%CVE-2024-27359HIGHCertain WithSecure products allow a Denial of Service because the engine scanner can go into an infinite loop when processing an archive filEPSS 0.7%CVE-2024-10907HIGHDenial of Service (DoS) via Multipart Boundary in lm-sys/fastchatEPSS 0.7%CVE-2022-4345MEDIUMInfinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service EPSS 0.7%CVE-2021-3508—A flaw was found in PDFResurrect in version 0.22b. There is an infinite loop in get_xref_linear_skipped() in pdf.c via a crafted PDF file.EPSS 0.7%CVE-2024-34487HIGHOFPFlowStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via inst.length=0.EPSS 0.7%CVE-2024-36990MEDIUMDenial of Service (DoS) on the datamodel/web REST endpointEPSS 0.7%CVE-2026-103492MEDIUMIn JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachmentsEPSS 0.7%CVE-2023-20200HIGHA vulnerability in the Simple Network Management Protocol (SNMP) service of Cisco FXOS Software for Firepower 4100 Series and Firepower 9300EPSS 0.7%CVE-2024-34488HIGHOFPMultipartReply in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via b.length=0.EPSS 0.7%CVE-2024-34489HIGHOFPHello in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via length=0.EPSS 0.7%CVE-2024-32976HIGHEnvoy can enter an endless loop while decompressing Brotli data with extra inputEPSS 0.7%CVE-2026-54904HIGHconcurrent-ruby: `AtomicReference#update` livelocks when the stored value is `Float::NAN`EPSS 0.7%CVE-2026-54538HIGHxrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADEREPSS 0.7%CVE-2023-42815LOWDenial of service from malicious image manifest in kyvernoEPSS 0.7%CVE-2023-42814LOWDenial of service from malicious image manifest in kyvernoEPSS 0.7%CVE-2026-63968HIGHipv6: fix possible infinite loop in fib6_select_path()EPSS 0.7%