Skip to content
OpenAdvisories

Weakness (CWE)

CWE-606: Unchecked Input for Loop Condition

Base Draft

The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

How to prevent it (2 mitigations)

  1. Implementation

    Do not use user-controlled data for loop conditions.

  2. Implementation

    Perform input validation.

Source: MITRE CWE-606

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-27145 Public exploit

    Inefficient candidate hostname parsing in crypto/x509

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

    Go standard library crypto/x509 stdlib golang-1.19 Debian Ubuntu Go
  • Medium 5.3
    CVE-2026-5950 Public exploit

    Unbounded resend loop in BIND 9 resolver

    An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Alpine