Falhas do tipo CWE-835

424 resultados

Loop infinito com condição de saída inalcançável

O programa entra em um loop cuja condição de parada nunca é satisfeita, fazendo-o executar indefinidamente. Isso consome recursos (CPU, memória) sem progresso, causando travamento, negação de serviço ou comportamento impredizível da aplicação.

Exemplo

Um validador de entrada que loop enquanto o valor não é válido, mas nunca atualiza a variável de controle; ou uma fila de processamento que tenta desempilhar itens, mas a condição de parada verifica uma variável que nunca muda. O servidor fica preso processando eternamente.

Como mitigar

Revisão de lógica: garantir que toda variável usada na condição de saída seja modificada dentro do loop. Implementar timeouts e limites de iteração como salvaguarda. Testes com entrada válida, inválida e edge cases para detectar loops travados antes do deploy.

CVE-2025-3857HIGHInfinite loop condition in Amazon.IonDotnetEPSS 0.6%CVE-2026-13397HIGHHTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributesEPSS 0.6%CVE-2022-42721MEDIUMA list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attEPSS 0.6%CVE-2026-43871HIGHApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limitEPSS 0.6%CVE-2025-20136HIGHCisco Adaptive Security Appliance and Firepower Threat Defense Software Network Address Translation DNS Inspection Denial of Service VulnerabilityEPSS 0.6%CVE-2023-20116MEDIUMA vulnerability in the Administrative XML Web Service (AXL) API of Cisco Unified Communications Manager (Unified CM) and Cisco Unified CommuEPSS 0.6%CVE-2026-33891HIGHForge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero InputEPSS 0.6%CVE-2026-66730HIGHfacil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body ParserEPSS 0.6%CVE-2026-33013HIGHMicronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indicesEPSS 0.6%CVE-2025-23221MEDIUMFedify has an Infinite loop and Blind SSRF found inside the Webfinger mechanismEPSS 0.6%CVE-2025-1695MEDIUMNGINX Unit Java VulnerabilityEPSS 0.6%CVE-2025-20243HIGHCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service VulnerabilityEPSS 0.6%CVE-2026-44186HIGHApache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftpEPSS 0.6%CVE-2024-5949MEDIUMDeep Sea Electronics DSE855 Multipart Boundary Infinite Loop Denial-of-Service VulnerabilityEPSS 0.6%CVE-2024-6227HIGHInfinite Loop in aimhubio/aimEPSS 0.6%CVE-2025-13335MEDIUMLoop with Unreachable Exit Condition ('Infinite Loop') in GitLabEPSS 0.6%CVE-2025-64438LOWFast-DDS: Unbounded GAP range triggers OOM DoS under RELIABLE QoSEPSS 0.6%CVE-2023-36807MEDIUMInfinite Loop when reading malformed objects in pypdfEPSS 0.6%CVE-2024-25144MEDIUMThe IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 beforeEPSS 0.6%CVE-2026-59843MEDIUMLibssh: libssh: denial of service via zero advertised channel packet sizeEPSS 0.6%