Falhas do tipo CWE-835

527 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2026-63968HIGHipv6: fix possible infinite loop in fib6_select_path()EPSS 0.7%CVE-2025-20136HIGHCisco Adaptive Security Appliance and Firepower Threat Defense Software Network Address Translation DNS Inspection Denial of Service VulnerabilityEPSS 0.7%CVE-2026-84997HIGHreact/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPUEPSS 0.7%CVE-2023-51075HIGHhutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. This vulnerability allows attackersEPSS 0.7%CVE-2024-40060HIGHgo-chart v2.1.1 was discovered to contain an infinite loop via the drawCanvas() function.EPSS 0.6%CVE-2022-42721MEDIUMA list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attEPSS 0.6%CVE-2026-10686MEDIUMMissing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routersEPSS 0.6%CVE-2026-39806HIGHHTTP/1 chunked decoder infinite loop on requests with trailer fields in banditEPSS 0.6%CVE-2024-10821HIGHDenial of Service (DoS) in invoke-ai/invokeaiEPSS 0.6%CVE-2026-34282HIGHVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: NetworkEPSS 0.6%CVE-2023-43761HIGHCertain WithSecure products allow Denial of Service (infinite loop). This affects WithSecure Client Security 15, WithSecure Server Security EPSS 0.6%CVE-2025-20243HIGHCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service VulnerabilityEPSS 0.6%CVE-2026-69210HIGHHttp4s: WebSocket decoder accepts negative length, causing infinite decode loopEPSS 0.6%CVE-2026-82560HIGHPod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output widthEPSS 0.6%CVE-2026-81876HIGHHAPI FHIR: SHCParser DEFLATE infinite loop causes denial of serviceEPSS 0.6%CVE-2026-64611HIGHLibcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()EPSS 0.6%CVE-2024-45692HIGHWebmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.EPSS 0.6%CVE-2025-3857HIGHInfinite loop condition in Amazon.IonDotnetEPSS 0.6%CVE-2026-59935HIGHpypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)EPSS 0.6%CVE-2025-23221MEDIUMFedify has an Infinite loop and Blind SSRF found inside the Webfinger mechanismEPSS 0.6%